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A new sensor/actuator failure analysis technique for turbofan Jet 
engines is developed. The technique utilizes redundant information em- 
bedded in the engine model residual and does not require multiple hard- 
ware redundancy. 

Three phases of failure analysis, namely detection, isolation, and 
accommodation are considered. Failure detection and isolation techniques 
are developed by utilizing the concept of Generalized Likelihood Ratio 
(GLR) tests. These techniques are applicable to ':oth time-varying and 
time- invariant systems. Three GLR detectors are developed for: (1) hard- 

over sensor failure; (2) hard-over actuator failure; and (3) brief dis- 
turbances in the actuators. The probability distribution of the GLR de- 
tectors and the detectability of sensor/actuator failures are established. 
Failure type is determined by the maximum of the GLR detectors. Failure 
accommodation is accomplished by extending the Multivariable Nyquest Array 
(MNA) control design techniques to nonsquare system designs. 

The performance and effectiveness of the failure analysis technique 
are studied by applying the technique to a turbofan jet engine, namely the 
Quiet Clean Short-Haul Experimental Engine (QCSEE) . Single and multiple 
sensor/actuator failures in the QCSEE are simulated and analyzed and the 
effects of model degradation are studied. 
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CHAPTER I 


INTRODUCTION 

1.1 Overview of Dissertation 

The objective of this dissertation Is to develop a sensor failure 
detection, Isolation, and accommodation technique for air breathing 
propulsion systems. For this purpose a new detection and isolation 
technique based on testing the engine model residuals (the difference 
between the engine output and an engine model) is developed. The tech- 
nique uses the redundant information available In dissimilar output 
measurements, thus eliminating the need for hardware redundancy. The 
concept of the Generalized Likelihood Ratio (GLR) (Ref. 31) is used to 
extract the detection information from the model residuals. Isolation 
of a failed sensor is achieved by estimating the direction and magni- 
tude of the failure in the output space. Since in the proposed scheme 
a model of the engine would be available, the accommodation of a failed 
sensor can be achieved in three alternative ways. The first method is 
to replace the lost measurement with the corresponding measurement from 
the model. In the second method the control design configuration is 
changed by discarding the lost measurement and substituting a different 
measurement from the engine. Finally, as a third alternative, the 
failed sensor is discarded and a new design incorporating fewer sensors 
is implemented. To accomplish the reconfiguration of the control 
design a new nonsquare Multivariable Nyquist Array design procedure is 
developed. The detection, isolation, and accommodation techniques 
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developed in this dissertation are compatible with an on-board digital 
realization of an engine control system. 

The remaining sections of this chapter provide a description of 
motivations, objectives and the necessary background for the develop- 
ment of the failure analysis technique. The organization of these 
sections is as follows. A brief description of the jet engine opera- 
tion is presented in the next section. The engine control requirements 
and the future control systems of the jet engine are discussed in 
Section 1.3. Since the development of the detection technique is 
closely related to the design of the engine control system, the appli- 
cations of control design techniques to the problem of engine control 
is reviewed in Section 1.4. In Section 1.5 three phases of sensor 
failure analysis are discussed. A brief review of the failure analy- 
sis techniques is presented in Section 1.6. Finally in Section 1.7 the 
objectives of this dissertation are defined and the outline of the 
proposed solution is presented. 

1.2 Jet Engines 

The history of the jet engine goes back to the year 1908. In that 
year, Rene Lorin, a French engineer proposed the use of hot gas pulses 
that would be expelled through a nozzle to generate propulsive thrust. 
However, it was not until the 1940’s that the first jet engine was 
used to propel an aircraft (Ref. 64). 

The main purpose of the jet engine is to generate thrust. To 
understand jet engine operation, consider the schematic diagram of a 
single spool turbojet engine and the corresponding ideal fluid pro- 
cesses diagram in Figure 1.1. The engine generates thrust by expelling 
high-velocity gases from the exhaust nozzle. This is achieved by the 
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following processes (ideal case): 

0- 1 : Large quantities of air are brought into the engine 

through the inlet duct. This will either accelerate 
or decelerate the air. There is a pressure and 
temperature increase associated with this process 
while the entropy remains constant (isentropic process). 

1- 2 : The velocity of the air is decreased through the inlet 

diffuser while the pressure and temperature continue to 
increase. In this process the entropy remains constant. 

2- 3 : The air is compressed in the compressor raising its 

pressure to the maximum cycle pressure. The rise in 
pressure is accompanied by an inciease in air tempera- 
ture, but the entropy does not change. 

3- 4 : The compressed eir is passed on to the combustion 

chamber where the fuel is sprayed into the front of the 
chamber. The mixture of the air and fuel is burned, 

*.hu3 increasing the air temperature to the maximum 
cycle temperature. The pressure remains constant and 
the entropy increases. 

4- 5 : The hot gases produced in 3-4 are expanded through 

the turbine blades producing rotation of the turbine 
t rotors. During this process the pressure and tempera- 

ture drop and the entropy stays constant. 

5 - 6 : The exhaust gases from the turbine are expelled through 

the nozzle thus increasing the air velocity. 

The ideal turbojet engine cycle in Figure 1.1 corresponds to a tempera- 
ture-entropy diagram of a Bray ton cycle (Ref. 41). 
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To start a Jet engine the compressor is turned using a starter 
motor. Simultaneously, fuel is added and spark ignited in the com- 
bustion chamber. When the compressor is rotating at sufficient speed, 
the starter and the ignitors are turned off. The engine will continue 
operating as long as fuel and air are supplied t;o the ergine in proper 
proportions. Controlling the proper fuel-air ratio in the mixture is 
a must for safe operation of the engine. Excessive fuel could result 
in exceedingly high rotor speed, high turbine inlet temperature, and 
perhaps engine damage by violating its physical constraints. On the 
other hand, very lean fuel-air mixture could result In the engine 
shutting off. The problem of controlling the proper fuel-air ratio 
can be divided into two parts. The first part is how to accelerate 
the engine without violating its physical constraints and the second 
part is how to maintain steady-state operation as disturbances occur. 
These control requirements and the increased demand for higher thrust- 
weight ratio led jet engine designers to develop engines with more con 
trols in addition to the fuel flow. Variable nozzle area, variable 
fan pitch angle, variable compressor vane position, and variable inlet 
guide vane are examples of the additional controls which are now avail 
able on the more sophisticated jet engines (see, e.g.. Ref. 47). 

The addition of these Input controls to the engine increases the 
complexity of the engine control problem. Hence, more sophisticated 
control systems are required to fully utilize the benefits of the 
additional input controls. A brief discussion of the control systems 
used to solve the engine control problem is presented in the next 


section. 
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1.3 Engine Control System 

A general configuration of the engine control system is shown in 
Figure 1.2. The sensors measure engine output variables such as speed, 
pressure, and temperature. A septate set of sensors measure environ- 
mental conditions such as altitude, atmospheric pressure and tempera- 
ture. The engine output measurements and the environmental conditions 
are transferred to the computation apparatus of the control system. 

The physical constraints of the engine such as maximum allowable rotor 
speed and turbine inlet temperature are normally stored in the comput- 
ing element. The computation apparatus utilizes the environmental and 
engine measurements to compute the difference between the desired out- 
put and the actual engine output. Based on the engine physical con- 
straints and the output discrepancies the appropriate input signals 
are computed. The input signals are then transferred to the actuators 
(e.g., a fuel metering valve and a motor that changes the engine 
nozzle area are examples of typical jet engine actuators) (Ref. 45). 

At first the main requirement of the engine control was to achieve 
the desired speed without violating physical constraints. The control 
input to the engine was fuel flow and simple hydroraechanical devices 
were used to achieve this control objective. For example, a simple 
flyball speed governor that directly controlled the fuel input was 
used to maintain steady-state speed. As the engines became more 
sophisticated in order to deliver higher thrust and provide faster 
response, more complex hydroraechanical cortrol systems evolved. 

Today, hydromechanical controls are still the most commonly used 
types of control. However, hydromechanical controls will gradually 
be giving their place to the electronic controls. This is due to two 
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major reasons. First* future aircraft engines will have a more com- 
plex structure, thus requiring the controls to manipulate more than 
six variables which is the practical limit of the hydromechanical 
controls (Ref. 9). The second reason is that high performance air- 
crafts require control integration between the e' gine and the air- 
craft. Hence, the future engine control system must be capable of 
processing more information and manipulating more inputs. 

The physical limitations and complex structure of hydromechanical 
controls motivated the designers of Jet engine control systems to con- 
sider electronic control as an alternative. Initially, the electronic 
controls were analog and ‘'hey are still the most commonly used type 
of electronic control. The analog computer, however, is sensitive to 
time and environmental changes and, hence, it is inherently less 
accurate than n digital computer. Furthermore, the modification of 
the programs in the analog computers are not easily achieved. Due to 
these considerations, the researchers raised the question of analog 
and/or digital computers for future engine control in the mid 1960's. 
Predictions since then indicate that future engine controls will be 
digital. The main reasons for such predictions are the flexibility of 
programming and the capability of storing large amounts of data. Also, 
the modification of the digital computer after its development is 
usually more feasible than the analog computers. 

From an economical point of view, the application of digital con- 
trols will result in a substantial saving. In their study Sevich and 
Newrith (Ref. 10) indicate that the savings will be in fuel consump- 
tion, lower life-cycle cost, and reduced engine maintenance. Accord- 
ing to Yafee (Ref. 11) a savings of 1 % in fuel consumption results In 
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a savings of four (4) billion gallons of fuel p«ir year for Just the 
wide-body transports In service (based on 1976 data). 

Reliability of the digital electronic controls Is still a major 
problem in the application of these controls. System reliaoility can 
be improved however in several areas. With the advancement in solid- 
state electronics, more logic transfers and circuit hardware can be 
incorporated per chip, hence reducing the number of components. The 
reduction in the number of components improves the overall reliability 
of the control system. Reliability can also be improved by using 
redundant components. This is referred to as hardware redundancy. 
Recently researchers have considered using the redundant information 
that is available from dissimilar components to detect a failure. The 
redundant information is referred to as analytical redundancy. The 
main advantage of using analytical redundancy is that it eliminates the 
need for redundant components. This is particularly of interest for 
future jet engines as the number of inputs and outputs on these engines 
will be higher and the use of hardware redundancy might be impractical. 
The sensor failure detection technique developed in this dissertation 
utilizes the concept of analytical redundancy. 

In summary, the trend in the research and development of the jet 
engine control system indicates that the future control system will be 
• digital. The major concern about the digital controls is the reli- 

ability of such systems. Due to the complexity of future aircrafts 
r 

it is not feasible to use hardware redundancy to improve the reliabil- 
ity of the control system. The advent of high speed digital computers 
with large storage capability has made it possible to consider the use 
of analytical redundancy. The development of failure detection 
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techniques which utilize analytical redundancy 1 b affected by the 
design of the control system. Therefore, the next section is devoted 
to the discussion of modern control design techniques for jet engines. 
1. 4 Design of the Control S ystem 

In achieving the desired eng ne performance, the design methodol- 
ogy of the engine control system plays an important role. In the past 
control laws were designed by classical frequency response techniques. 
During this period, techniques were limited to single input-single out- 
put linear time-invariant systems. The application of the classical 
technique to a multivariable engine resulted in control laws that were 
designed for each input independently. When these independently 
designed control laws were implemented, severe interaction resulted and 
performance degradation occurred. Alternatively, the increase in com- 
oxity oL future engines to achieve higher performance (e.g. , high 
thrust-weight ratio) has also contributed to the need for multivariable 
engine controls. The classical control techniques cannot be used to 
design these systems unless cross coupled interactions are taken into 
consideration. Therefore, researchers have considered the use of 
multivariable design techniques in both the frequency and time domain 
(Ref. 16). 

Some multivariable design techniques utilize all the relationships 
between inputs and outputs to achieve the desired engine response, 
hence using input interaction in a favorable manner. One such time- 
domain technique is Linear Quadradic Regulator (LQR) theory. Appli- 
cations of this theory to jet engine control were studied by Michael 
and Farrar (Ref. 13), Merrill (Ref. 6), Beattie and Spock (Ref. 42), 
and De Hoff and Hall (Ref. 43). Recently a practical altitude test 
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cell demonstration of LQR theory application to a F100 turbofan engine 
was reported by Lehtinon et al (Ref. 22). 

in the area of frequency domain techniques McMorran (Ref. 14) 
used the Inverse Nyquist Array to design a controller for a gas 
turbine. Other applications of Inverse Nyquist Array to jet engines 
has been reported by Leininger (Ref. 19), Spang (Ref. 21), and Sain 
et al (Ref. 44). Recently the use of alternative multivariable control 
design technique for jet engines has been addressed in numerous stud- 
ies. Ar. excellent collection of these studies can be found in 
reference 16. The volume of the research and the recent practical 
demonstration of the multivariable control techniques indicate that 
such techniques will be the design tools of future engine control 
systems. 

Among the multivariable frequency domain techniques the Inverse 
Nyquist Array (INA) , (Ref. 17) and the Direct Nyquist Array (DNA) , 

(Ref. 18) are the natural extension of the classical frequency 
response techniques. In these Multivariable Nyquist Array (MNA) 
techniques the cross-coupled system interaction is reduced by making 
the transfer matrix diagonally dominant. After the dominance is 
achieved the control loops are designed separately by utilizing the 
classical frequency response tools. The use of tools such as Nyquist 
and Bode diagrams and Nichols chart is particularly appealing to a 
broad range of designers. Designing each control loop separately 
provides insight for MNA designers about the input-output relations 
in the system. Application of the MNA to the jet engine control 
pruolem (Refs. 14,19,20,21) results in a set of simple compensators 



which provide the desired response. These studies conclude that 
MNA promises to be a viable alternative design method for the jet 
engine application. 

Successful application of the MNA techniques, like any other 
design method, depends on the information provided to the control 
system by the sensors. Loss of information due to a sensor failure 
decreases the control system effectiveness, thus degrading the engine 
performance. Therefore, it is essential to identify the failed 
sensor and take appropriate corrective action. When multiple redun- 
dant sensors for the lost measurement are not available , then a failure 
must be accommodated in one of the following ways. The first method 
is to synthesize or estimate the lost measurement from the other 
measurements. The second approach is to reconfigure the control 
system. In rearranging the engine control system, the design meth- 
odology plays a significant role. Since in the MNA method each loop 
is designed separately, a relative independence exists among the loops 
that can be used to reconfigure the controls. It Is one objective of 
this dissertation to develop this new approach for failure accommoda- 
tion. 

In summary, the design tools for future engine control systems 
will be the multivariable design techniques. Control systems designed 
by such techniques rely on sensors for output information. Therefore, 
in the event of a sensor failure it must be detected and accommodated. 
The MNA design technique promises to facilitate the accommodation of 
the failure. In the next section sensor failures and different phases 
of sensor failure analysis are discussed further. 
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1.5 Sensor Failure Pr o blem 

A jet engine control system depends on the engine output informa- 
tion to maintain the high level of performance. The output information 
is supplied to the control system by temperature, speed, and pressure 
sensors. If a sensor in the control loop (see Fig. 1.2) fails, the 
control system will be effected directly and hence the performance of 
the engine will be degraded. The level of degradation due to a sensor 
failure depends on the type of the failed sensor (i.e. temperature, 
pressure, or speed sensor) and also on the reaction of the control 
system to the failure. Thus, the reliability and safety of the engine 
control and ultimately the engine itself is related to the reliability 
of the sensors and the actions of the control system after the sensor 
failure. 

Sensor failures are generally categorized into two groups: soft 

and hard failures. For this purpose the sensor output is viewed as a 
combination of the true measurement and a random noise. In case of 
no failure the mean of the sensor output is the true measurement and 
the variance is the same as the variance of the noise. If the mean 
of the sensor output deviates from the true measurement by a large 
margin, then a hard fail .ire has occurred. Alternatively, when the 
variance of the sensor output exceeds a certain tolerable value, a 
soft failure is declared. 

A complete sensor failure analysis of any system can be divided 
into three phases: detection, isolation, and accommodation. In the 

detection Phase, the concern is to establish the occurrence of the 
failure. Ideally, a detection technique should detect both soft and 
hard failure. This, however, is not easily accomplished in a dynamic 
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system. After the detection it is necessary to isolate the failed 
sensor so ‘hat the effect of the failure can be reduced. The task of 
isolating a failed sensor becomes more complicated when multiple hard- 
ware redundancy does not exist. This is, of course, due to the fact 
that the output of redundant sensors cannot be compared with each other. 
It is, however, possible to utilize the available redundant information 
from dissimilar sensors to isolate a failure. The third phase of sensor 
failure analysis is to accommodate the failed sensor in the system. 
Specifically, the accommodation of a failure is to identify and imple- 
ment the necessary changes in the control system to maintain safe 
operation with minimal performance loss. The methods of accommodating 
a failure when analytical redundancy is used can be divided into two 
groups: fixed and variable. Tf the measurement corresponding to the 

failed sensor can be synthesized or estimated, the control configura- 
tion can remain unchanged or fixed and the estimate is used in place 
of the failed sensor output. For variable accommodation the control 
loops are reconfigured to provide the control action without utilizing 
the output corresponding to the failed sensor. 

Based on the discussion in this section, the main objectives of 
any sensor failure analysis are: detection, isolation, and accommoda- 

tion. Utilizing analytical redundancy - a must for future complex 
engines - requires more sophisticated failure analysis methods. A 
brief review o ; such techniques is presented in the next section. 

1.6 Failure Analysis Techniques 

Traditionally, the problem of sensor failure is solved by 
utilizing multiple redundant sensors. A simple majority voting system 
will determine the failed sensor by comparing the output of the 
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redundant sensors. The output of the failed sensor is disregarded 
and the output of a similar unfailed sensor is substituted. For the 
detection of a failure at least three independent measurements of the 
same variable must be available. Although the voting technique does 
not necessarily require that each variable be sensed by three identi- 
cal sensors, it does require that a large number of redundant sensors 
be added to the system. On the other hand, if one takes advantage of 
unlike sensors to compute duplicates of the measurements, the detection 
logic becomes complicated. The voting technique has generally been 
used for hard failure detection. An application of this method is 
reported by Oilmor and McKern (Ref. 25). Pejsa (Ref. 26) developed 
an optimum arrangement for redundant sensors. However, the basic 
drawback of voting techniques is the requirement of multiple redun- 
dancy. Since future engines will require more sensors the multiple 
redundancy requirement would make a voting technique too complex to 
be useful. 

The complexity of future engine control systems dictates the use 
of an on-board digital computer for engine control purposes. The 
recent advances in solid state electronics allows design of small 
computers with large stjrage and high computation speed for on-board 
utilization. The storage and speed capabilities of the on-board 
computers provide an opportunity for the development of failure 
detection techniques which use analytical redundancy. The main idea 
behind such techniques is to extract the failure detection informa- 
tion from the output of dissimilar sensors, 

Tn recent years researchers have proposed various analytical 
approaches to the problem of sensor failure. One approach is to use 
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Kalman filters (Kef. 2 7) to remove the ef feels of the failure from the 
outputs of the engine. For this purpose a sot of Kalman filters were 
designed that a r e sensitive to abrupt changes in tlie system (e.g., see 
Jazwinski , Ref. 28). Increasing the sensitivity of the filters, how- 
ever, may severely degrade the performance of the system under the 
normal operation without any failure. Another drawback is that the 
failure sensitive filters do not provide any isolation capability. To 
add the isolation capabilitv to this method, Kerr (Ref. 29) has inclu- 
ded the failure biases as states. Then a large estimate of the bias 
state indicates the failure. Inclusion of the failure biases as states 
increases the dimension of the system and may degrade the performance 
of the system (Ref. 30). TVo successful attempts in the area of 
failure-sensitive filters have recently been made by Beard (Ref. 58) 
and Jones (Ref. 59) which have an isolation capability. They design 
a filter such that its residual carries the detection and isolation 
information. The filter, however, is suboptimal and the implementation 
logic is considerable. 

A more popular approach in the development of the computational 
techniques has been to use the innovations of Kalman filters to test 
for failure in the system. Montgomery et al (Refs. 12,32) by associa- 
ting different hypotheses with each failure mode use the innovation 
process to test these hypotheses statistically. A major difficulty 
with hypothesis testing is the need for a bank of filters for 
generating the innovat ions . In a similar fashion Wells (Ref. 60) 
formulates a Baysian risk function which incorporates the risk 
associated with various modes of failure. He selects ‘'he hypothesis 
which minimizes the risk function. Wells h s studied the application 
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of thLs technique to jet engine sensor failure; however, he indicates 
that due to the requirement of a bank of filter the on-line implementa- 
tion if impractical. In a somewhat different approach Mehra and 
Peschon (Ref. 33) have developed a chi-squared test for examining the 
whiteness of the innovations. The application of this simple tech- 
nique by Willsky et al (Kef. 34) has produced mixed results. The 
method does not provide any isolation information and only those 
failures which significantly effect the innovations are detected. 

More subtle failures are difficult to detect with this technique. 

In their study of sensor failures in jet engines Corley and 
Spang (Ref. 35) have used engine measurement errors and an engine 
model to test for sensor failures. Assuming white Gaussian plant 
and measurement noise, they compare the absolute value of the 
measurement errors in each sample interval against a threshold to 
test for the failure. The major disadvantage of this technique 
is that it only utilizes the information contained in one sample 
interval for failure detection. 

An alternative way of testing the innovations for failure 
detection is to use the concept of Generalized Likelihood Ratio 
(GLR) . The concept of ( LR is described by Sage and Melsa (Ref. 31) 
and by Van Trees (Ref. 36). Willsky and Jones (Ref. 37) used the 
concept of GLR to develop a jump failure detection technique for 
linear systems. In their approach they use the innovations of a 
Kalman-Bucy type filter to develop the likelihood ratio. Since this 
ratio has a knowr. distribution it can be used to test the hypothesis 
of no failure versus failure. The GLR method has been applied to the 
detection of cardiac arrhythmias and the results have been extremely 
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impressive (Ref. 38). The advantage of CI.R is that it provides both 
an estimate of the size of the jump and the time of the failure. The 
GLR is mainly a detection technique, but under additional assumptions 
(Ref. 37) it provides isolation information. However, GLR does not 
accommodate the failure and it has to be complemented with an 
accommodation technique. 

The preceding techniques are mainly compatible with a control 
system designed by a multivariable time domain control technique. On 
the other hand, the potential advantages that new multivariable tre- 
quency domain control techniques can offer with respect to the sensor 
failure detection/accommodation problem are yet to be explored. Tills 
dissertation is an attempt to respond to the need for such explora- 
tion. In the next Section the objectives of this dissertation are 
defined and the proposed approach is outlined. 

1.7 Dissertation Objectives 

Tiie development of a sensor failure analysis for a jet engine is 
higlil” influenced by the design philosophy of the engine control 
system. This influence can ultimately effect the speed and accuracy 
of the failure detection system. Most of the failure detection tech- 
niques are developed to operate with a control system designed by the 
multivariable time domain techniques. The recent development of the 
Multivariable Frequency Domain (MVFD) techniques (e.g.. Refs. 18,39) 
has opened a new frontier in sensor failure detection analysis. The 
Multivariable Nyquist Array (MNA) (Refs. 19,20), a MVFD technique, 
is particularly of interest. In the MNA design the estimation of 
system states is not required and each input-output is designed 
separately. These two characteristics of the MNA design and the 
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successful application of the MNA technique to the jet engine control 
problem (Ref. 16) suggests that MNA is an excellent candidate for 
exploring the potential benefits of MVFD techniques. Specifically, 
it is important to determine the logic simplifications and the com- 
putational savings that result from the use of MNA design. In 
response to this need the objectives of this dissertation are defined 
as follows: 

1 - To introduce the failute accommodation capability in the MNA 

design and develop the reconfiguration scheme for on-board 
utilization . 

2 - To develop a failure detection and isolation technique based 

on the MNA design for on-board implementation. 

Tine proposed solutions to the problems corresponding to the above 

objectives are presented in the following chapters. In Chapter II a 

new approach for failure detection is proposed and by utilizing the 

concept of Generalized Likelihood Ratio (CI.R) a failure detection 

technique is developed. Important statistical properties of this 

detection technique are derived in Chapter I I T . Chapter IV is 

devoted to the application results of the proposed failure analysis 

technique to a Quiet Clean Short-haul Experimental Engine (QCSEE) . The 

problem of failure accommodation is addressed in Chapter V where 

a new accommodation technique based on MNA design methodology is 

developed. The application results of the accommodation technique to 

QCSEE are also presented in Chapter V. Finally, in Chapter VI a 

summary of the dissertation and recommendations for future research 
are discussed. 



CHAPTER II 


GENERALIZED LIKELIHOOD RATIO DETECTION TECHNIQUE 
2.1 Introduction 

The value of an on-board digital computer for future jet engine 
control was examined in Chapter I. With the availability of low-cost 
digital computers and their increased storage and speed capabilities, 
more advanced failure detection techniques can be studied in order to 
improve overall engine reliability and perfoimance. In this chapter a 
sensor-actuator failure detection technique based on the concept of the 
Generalized Likelihood Ratio (GLR) (Ref. 36) is developed. The tech- 
nique consists of performing hypothesis testing on the difference be- 
tween the engine output measurements and the output of an engine model. 
The hypotheses correspond to various modes of failure in the system 
sensors or actuators. The technique provides a simple decision function 
and an estimate of the time of the failure. Also estimates of bias in 
the outputs or states due to a sensor or actuator failure can be easily 
computed. The technique is developed for linear dynamic systems and, 
therefore, its application is not restricted to jet engines. Prior to 
the mathematical development of the technique the configuration of the 
detection scheme is described in the next section. Then a general for- 
mulation of the technique for time-varying systems is presented in Sec- 
tion 2.3. In Section 2.4 the special case of failure detection in a 
time-invariant system is treated and then in Section 2.5 recursion re- 
lations for computer implementation of the time-invariant case are de- 
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veloped. A brief treatment of soft failures in output sensors is pre- 
sented in Section 2.6. Finally, a summary and discussion of the devel- 
opments in this chapter are presented in Section 2.7. 

2.2 Generalize d Likelihood Ratio Detection Scheme 

The idea of using a Generalized Likelihood Ratio (GLR) test for 
failure detection in dynamic systems has been investigated by Willsky and 
Jones (Ref. 1). Figure 2.1 illustrates their proposed detection scheme. 
Under this scheme, a Keiman-Bucy filter is used to estimate the output 
of t' e plant. The estimated output is then subtracted from the actual 
plant output. The difference between the estimated and actual measure- 
ment, referred to as the residual, is used to test for failure occur- 
rence in the plan. The development of the technique is based on the 
assumption that under no-failure operation each residual is a zero mean 
white Gaussian noise process. If a component fails, however, the resi- 
duals will no longer have zero mean. Pased on these assumptions the 
detection of a failure is equivalent to testing the mean of the resi- 
duals for deviation from zero. Testing the mean of the residuals can 
be achieved statistically by testing the hypotheses corresponding to 
failure and no-failure modes. Specifically 
H q : No failure occurred 

(i.e., the mean of the residuals is zero) 

: A failure occurred 

(i.e., the mean of the residual is nonzero) 

To test the above hypotheses the GLR method is used. For this purpose 
the likelihood function corresponding to hypothesis is divided in- 

to the liklihood function for Hq. Based on the desired degree of con- 
fidence in the defection results, a threshold can be selected as the 
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upper limit of the value of the likelihood ratio under no failure. A 
failure is declared if the likelihood ratio exceeds this threshold. 

This is called the decision rule. 

To estimate the outputs, a Kalman-Bucy filter must estimate the 
states. State estimates from the Kalman-Bucy filter (Fig. 2.1) can, at 
the same time, be used for the purpose of controlling the plant. This, 
of course, would be the case only if state estimates are required in 
the design of the control system. Such is the case in standard linear 
quadratic state regulator designs. Alternatively, if the control de- 
sign of the plant is based on a technique which does not require state 
estimates (e.g., as in the case of the Multivariable Nyquist Array 
technique) then the Kalman-Bucy filter wilj oily serve the purpose of 
generating residuals for failure detection. In this case alternative 
means for generating the residuals can be considered. The motivation 
for such consideration is as follows. The output estimates from the 
Kalman-Bucy filter are dependent on the plant output measurements. 

Thus a failure in either sensors or actuators would not only effect the 
output of Jie plant but also the state estimates and hence the output 
estimates. The dependence of the output estimates on plant measure- 
ments excludes the option of replacing the lost measurement, in case of 
a failure, with its estimate. In addition, since the state estimates 
(and, consequently, the residuals) are affected by sensor output, then 
even brief and scattered sensor disturbances have to be considered in 
the failure detection. This increases the number of failure modes and 
hence reduces the speed of detection, isolation, and accommodation of a 
failure. Therefore, it is important to consider alternative means of 
generating residuals. 
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One possible alternative for generating the residuals is to use a 
model of the plant that follows the dynamics of the plant closely and at 
the same time depends only on the input to the plant. In Figure 2.2 the 
Kalman-Bucy filter is replaced by a plant model. The model is required 
to follow the engine dynamics so that under a no-fallure condition the 
difference letween the actual plant output and the model output will be 
a zero mean white Gaussian noise process. Comparing Figures 2.1 and 2.2 
reveals that while the output estimate from the Kalman-Bucy filter de- 
pends on both the input and output of the system, the model outputs are 
only functions of the input and plant dynamics. Thus, if a sensor falls 
the model output will not be affected and could replace the lost mea- 
surement. Also the detection of brief disturbances in the sensors is no 
longer essential. This eliminates one mode of failure from considera- 
tion. Ar will be shown later the mathematical formulation of the GLR 
detection will be simpler when a model is used to generate the resi- 
duals. This nodification in the failure detection scheme requires that 
the likelihood ratio decision function be rederived for residuals com- 
puted by subtracting model outputs from plan*, measurements. In the next 
section the preliminary concepts and definitions for the development of 
the new detection technique are discussed and then the general formula- 
tion of the technique for linear time-varying systems is presented. 

2.3 Generalized Likelihood Ratio for Time-Varying Systems 

In the previous section an overview of the proposed Generalized 
Likelihood Ratio (GLR) detection scheme was presented. In this section 
the mathematical development of the GLR technique for the proposed de- 
tection plan (see Fig. 2.2) will be discussed. For this purpose it is 
first necessary to develop the system model. 




2.3.1 'Hie System Model 


The development of the failure detection technique in this section 
is based on the assumption that the dynamics of the system under study 
can be represented by the following linear time-varying discrete equa- 
tions : 


X(k ♦ 1) - (k)X(k) + B (k) U(k) + F a (k,t) 

<.(k) - H(k)X(k) + J (k) U(k) + Y(k) + F s (k,t) 
where the symbols in the above equations are defined as 


(2-1) 

( 2 - 2 ) 


X(k) : 

n 

X 

i 

State column vector 

<f(k) 

n 

X 

n 

System matrix 

B(k) 

n 

X 

m 

Input matrix 

U(k) : 

m 

X 

1 

Input column vector 

F a (k, c) : 

n 

X 

1 

Actuator failure function vector 

H(k) : 

8 

X 

n 

Output matrix 

J(k) : 

8 

X 

m 

Matrix (relating inputs to outputs; 

Y(k) : 

8 

X 

1 

Zero mean Caussian white noise process with the 





covariance matrix V(k) 

F s (k,t): 

8 

X 

1 

Sensor failure function vector 


Number of observations 
Time of failure occurrence. 


The functions F fl (k,t) and F g (k,t) are used to model the failure 
modes of interest. Such failure modes are hard-over actuator, a brief 
disturbance in the actuator, and hard-over sensor failures which are of 


main interest in a jet engine application. It should be mentioned that 
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even if only the detection of a sensor failure is of interest it may 
still he necessary to consider the other modes of fuilure because the 
effect of other failures on the residuals may resemble the effect of a 
sensor failure. Typically, hurd-over failures in actuators and sensors 
are modeled as step changes in the outputs of actuators or sensors. For 
brief disturbances in the actuator, a Jump function is used to model the 
failure. In the following a hard-over actuator and sensor failure will 
often be referred to us stute-step and sensor-step failure, respec- 
tively. Tire brief disturbances in the actuator will be referred to as a 
state-jump failure. These three modes of failure are modeled as fol- 
lows . 

1 . Hard -Over Actuator 

lor this type of failure the function F a (k,t) has the following 

form 

K a (k,t) - vo k+1>t (2-3) 

where v is a n * 1 column vector that denotes the unknown magnitude 
and direction o* ihe tailure and o^j is the unit step function de- 
fined as 



Setting the first subscript to k + 1 in (2- 3) assures that the effect of 
the actuator failure will be reflected in the output without any delay. 
2 . Actuator Brief Disturbances (Jump Failure) 

The function F a (k,t) for this type of failure is 

k+ 1 , t 


F.i (k , t ) - v$ 


( 2 - 5 ) 
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where v is defined in the same way as above and <5 1 ^ j is the 
Kronecker delta function representing a pulse at i * j , i.e., 

j" 0 i * J 

(2 ” 6) 

l 1 i - j 

3 . Hard-Over Sensor Failure 

The failure function F s (k,t) for this type of failure can be 
written as: 

Fg(k,t) ■ uo (2-7) 

k,t 

where v is a g * 1 column vector that represents the unknown mag- 
nitude and direction of the failure in the output space and o^j is 
the unit step function as was defined in equation (2-4). 

With the completion of modeling the system dynamics and different 
modes of failure, the next step is to model the residuals for the three 
failure modes. 

2.3.2 The Residual Model 

„n the proposed GLR detection plan (see Fig. 2.2) the residuals 
are defined as the difference between the actual output of the plant 
and the output of the plant model. The main assumption here is that 
under no failure, the residuals are a zero-mean white Gaussian noise 
process. Let r(k) denote the residuals and let r^(k) represent the 
residuals under no failure operation then 

r(k) = r 00 ( 2 - 8 ) 

p 

where r 1 (k)cR 6 and is a zero mean white Gaussian noise process with 
known covariance matrix V(k). When one of the three types of hard 
failure (explained above) occurs the residuals will no longer remain 
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equal to Tj(k). In fact the residuals will reflect the deviation that 
the failure induces in the plant output from the model output. There- 
fore, when a failure occurs the residuals will have the following form: 

r(k) - r^k) + r 2 (k) (2-9) 

where r 2 (k) is the unknown but nonrandom effect of the failure on the 
residuals. The term r 2 (k) not only signals the occurrence of the fail- 
ure but it also carries the information concerning the type of the fail- 
ure. To extract this information from r 2 (k), the effect of each fail- 
ure mode on the residuals must be studied. Hence, for each type of 
failure the form of r 2 (k) will be determined. 

1. Hard-Over Actuator (State Step) Failure 

To calculate the effect of hard-over (state step) failure on the 
residuals, consider the following equations 

X (k + 1) = 4> (k)X (k) + B(k) 'J(k) (2-10) 

P P 

X f (k + 1) = $(k)X f (k) + B (k)U (k) + o R+1 (2-11) 

where X f (k) is the value of the plant state due to failed conditions 

and X is the state value for unfailed conditions. The effect of the 
P 

failure on the states can be calculated by subtracting equation (2-11) 
from (2-10) and the result can be written as: 

X 2 (k + 1) = <Kk)X 2 (k) + o k+ljt v (2-12) 

where 

X 2 (k) = X f (k) - X (k; (2-13) 

is the change in the value of the states due to the failure. Note that 
X 2 (k) = 0 for k < t and for k >_ t X 2 (k) is calculated from equa- 
tion (2-12) where t is the time of the failure. 
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The closed form solution for equation (2-12) can be written as 


x 2 (k) 


r 


< 


k 

X)Q(M)V 

J-t 


V. 


0 


k > t 


k < t 


(2-14) 


where Q(k,j) is the discrete transition matrix obtained from solution 
of equation (2-12) as 

Q(k, j ) = 4>(k - 1 ) d 5 ( k - 2) . . . 4>(j) (2-15) 

where 

QU.j) = i . 


The effect of hard-over failure ^(k) on the residuals in equation 
(2-9) can be written as 


r 2 (k, t) 


H(k) 


- < 


LJ“t 


v. 


k > t 


k < 0 


(2-16) 


since ^(k) = H(k)X 2 (k), which follows from insertion of equation (2-14) 
into equation (2-2). For ease of reference equation (2-16) can be re- 
written as 


r 2 (k, t) = C 1 (k,t)v 


(2-17) 


where 


H(k) 


G 1 (k,t) = i 


£ Q( k ’j) 
U“t 


k > t 


(2-18) 


0 


k < t 
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the subscript 1 of dj(k,t) refers to the type of failure (l.e., hard- 
over actuator failure). 

2. Actuator Disturbance (Jump) Failure 

The effect of a brief disturbance on the value of the states can be 
computed by following the same approach as in the case of hard-over ac- 
tuator failure. In this case the change in the value of the states can 
be obtained by replacing o with 6 in equations (2.11) and 

K« ] y L KT 1 | t 

(2. 12) yielding 

X 2 (k + 1) - 4><«OX 2 (k) + 6 k+lft v (2-19) 

where X^Ck) is the change in the value of the states due to the Jump 
failure alone and <J> (k) , t * and v are the system matrix, Kronecker 

delta function, and failure vector, respectively. Note that X 2 (k) D 0 
for k < t and the solution to equation (2-19) can be written as 


X 2 (k) 


l" Q(k, t)v 
, 0 


k> t 
k < t 


( 2 - 20 ) 


where Q(k,t) is the discrete transition matrix as defined in equation 
(2-15). Therefore, the effect of this type of failure on the residuals 
can be calculated by multiplying X^(k) in equation (2-20) by the output 
matrix H(k) 


H(k)Q(k,t )v 


r (k , t ) - 


k >_ t 
k < t 


( 2 - 21 ) 


The above equation for r ? (k,t) can be rewritten as 
r 2 (k, t) - C 2 (k,t)v> 


( 2 - 22 ) 


where 



2fl 


[ II Ck)Q(k , L ) k >. t 

G ? (k,t)~< (2-23) 

l 0 k < t 

Tlir miiIimc r I () l 7 of (^(k ,t ) refer:; id Mm- t ypr <>l I ; i i Inn- (l.r., ae 
tuator jump failure). 

3 . Hard-Over (Step) Sensor Failure 

A hard-over sensor failure affects the residuals directly (see 
Fig. 2.2). Therefore, the corresponding r^(k,t) can be written as: 

r 2 (k,t) = o k t v (2-24) 

where j, and v are the unit step function and the failure vector 
k,t 

defined in equations (2-4) and (2-7), respectively. Then equation (2-24) 
can be written as: 

r 2 (k,t) = G^(k,t)u (2-25) 

where G^(k,t) is a null matrix for k < t and a g * g identity ma- 
trix for k ^ t. This completes the calculation of the effect of fail- 
ures on the residuals. 

In summary, to develop the GLR decision function it is necessary 
to determine how each type of failure affects the residuals. To achieve 
this, the hard-over failures and the brief disturbances were modeled as 
step and jump functions (see eqs. (2-3), (2-5), and (2-7)). Using these 
models, it was shown that (eqs. (2-17), (2-22), and (2-25)) the effect 
of the actuator and sensor failures on the residuals can be expressed in 
the general form of: 

r (k) = G.(k,t)v for i = 1,2,3 (2-26) 

where G^k.t) for i = 1,2,3 corresponds to hard-over actuator, brief 
disturbance in the actuator, and hard-over sensor failure, respectively. 
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The formulation in equation (2-26) proves to he particularly helpful in 
the mathematical development of GLR which will be discussed next. 

2.3.3 The Generalized Likelihood Ratio 

Application of GLR concept to the problem of failure detection 
rests on two basic assumptions. The first assumption is that for a no- 
failure mode the residuals are zero mean white Gaussian noise processes. 
Under the second assumption when a hard failure (any of the three types 
discussed in Section 2.3.1) occurs the residuals will no longer have 
zero mean but their Gaussian property is retained. Based on these as- 
sumptions, testing the hypothesis regarding the detection of a failure 
is equivalent to testing the hypothesis concerning the zero mean of the 
residuals. The null and the alternative hypotheses can be written as: 

No failure occurred 

(i.e., the mean of the residuals is zero) 

: Failure of type i has occurred 

(i.e., the residuals mean is nonzero) 

The type i = 1,2,3 refers to hard-over actuator, brief disturbances 
in the actuator, and hard-over sensor failures, respectively. The null 
and the alternative hypotheses can be expressed in terms of r(k) as: 

H : r (k) = r (k) 

U 1 (2-27) 

H i : r (k) = r^k) + G^k.tjv 

where r^(k) is defined in equation (2-9) and G^(k,t)v for i = 1,2,3 
a r e defined in equations (2-18), (2-23), and (2-25), respectively. The 
likelihood function for the above hypotheses can be established by con- 
sidering a sample of k residuals 


F q = Prob. (r(l). r(2), . . ., r(k)/H Q ) 


(2-28) 
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= Prob. (r(l), r(2), .... r(k)/H 1 > (2-29) 

where is the likelihood function for null hypothesis H^, and r(j) 

denotes the Jth residual and t and v are the failure time and fail- 
ure vector, respectively, and is the likelihood function for the hy- 

pothesis corresponding to ith type of failure. The likelihood func- 
tion depends on both time of the failure, t, and the failure vector 

v which are unknown. Since the probability distribution of the resid- 
uals is Gaussian the likelihood functions Fq and F^ can be written 
as: 



(2tt) 


^g /2 


[l)et V (j) ] 1//2 exp jj- -| 


r T (j)v‘ 1 (j)r(j)| 


(2-30) 



where V(j) Is the covariance matrix of the residuals. Based on the 
Neymann- Pear son lemma (Ref. 46), the ratio of the likelihood functions 
is formed to test the occurrence of a type i failure: 

A(k) = T . (2-32) 

F 0 

If A(k) exceeds the threshold limit e then a failure is declared. 
Since F is a function of t and v, the likelihood ratio A(k) is 
also a function of these variables. Both t and v are unknown and 
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they must be estimated before the Neymann-Pearson test can be applied. 

To estimate t and v the likelihood ratio A(k) is maximized with re- 
spect to these variables. The algebra of maximization can be simplified 
if the logarithm of A(k) is maximized instead of the A(k). Consider 
the natural logarithm of A(k) : 


In A(k) = In F 


In F 


0 



r T (J)V 1 (J)r(J) 



It can be shown (Ref. 51) that maximizing In A(k) is equivalent to max- 
imizing A(k) with respect to t and v, because the logarithmic func- 
tion is monotonic. Thus the values of v,t which maximize In A(k) 
will also maximize A(k). Taking the partial derivative of In A(k) 
with respect to v and equating the derivative to zero, yields 


v = 


Z g I ( j - 


t)v 


(j)G i (j,t) 



Z *1. 


t) V _1 ( j ) r ( j ) y 


(2-34) 


To simplify the notation tue following terms are defined: 
k 

c i ( k,t) = C^(j,t)v' 1 (j)G 1 (1,t) (2-35) 

1 = 1 


and 
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D l (k * t) " X G I^J .t )r (J ) (2-36) 

J-l 

therefore, v can be expressed in tenas of G^Ck.t) and D^fk.t) as 

v - c“ 1 (k,t)D 1 (k f t). (2-37) 

Substituting the equations C^(k,t) and O^fk.t) from equations (2-35) 
and (2-36), respectively, into equation (2-33) the expression for 
In A(k) becomes 

In A(k) - — |v T D i (k,t) + D^(k,t)v - v T C i (k,t)vJ (2-38) 

Substituting v from equation (2-37) for v in equation (2-38) 
yields : 

2 In A(k) * v T D i (k,t) (2-39) 

or alternatively 

2 In A (k) = D^(k,t)C~ 1 (k,t)D i (k,t) (2-40) 

In equation (2-40) the time of the failure, t, is still unknown and 
it must be estimated. Using equation (2-40) in place of equation (2-33) 
the maximum likelihood estimate of t can be obtained by maximizing the 
likelihood ratio with respect to t. Therefore, the Generalized Like- 
lihood Ratio for testing the occurrence of the ith type of failure 
can be expressed as 

L*(k, t) = 2 In A(k) = Max D^(k, tjc" 1 (k, OD^k, t) (2-41) 

t 

* 

where L^(k,t) represents the likelihood ratio for the ith type of 
failure and it is referred to as GLR index. 



33 


ORIGINAL PAGE IS 
OF POOR QUALITY 


In order to calculate Lj(k,t) f r ora equation (2-41) the term on 
the right-hand side of equation (2-40) must be computed for all pos- 
sible t (i.e., 0 < t <_ k) and the maximum value of these terms is 
* 

L^(k,t). The corresponding t is the estimate of the failure time. 

* 

Thus, to compute L^(k,t) and estimate t more of the terms of equa- 
tion (2-40) must be computed as k, the number of observations, in- 
creases. 

To make the estimation of t more feasible Wilsky and Jones 
(Ref. 1) suggest using a finite size window to restrict the range of t 

A 

to the interval k-M<_t<_k-N where M and N denote the window 
limits. Further suggestions in reference 1 include: 

1. Restricting the direction of failure vector, v , to a set of 
known directions in the state and output space. The GLR formu- 
lation resulting from this simplification is referred to as 
constrained GLR (CGLR) . 

2. Selecting only one direction for the failure vector (e.g. , the 
direction corresponding to the failure of a component with the 
highest probability of failure) . The GLR formulation corre- 
sponding to this type of simplification is called the Simplified 
GLR (SGLR) . 

The development of constrained GLR (CGLR) follows directly from 
equation (2-40). Substituting af^ for v in equation (2-33), where 
a is an unknown scalar and is the jth vector of the preselected 

directions, and maximizing with respect to a yields: 

[f^D <k,t)] 2 

2 In A(k) = — (2-42) 
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(2-43) 


In equation (2-42) the time of the failure, t, and the direction of the 
failure, J, are unknown. Thus the expression on the right-hand aide 
has to be maximized with respect to t and j. The maximization can 
be expressed as: 



(2-44) 


The development of the Simplified GLR (SGLR) is based on the as- 
sumption that the failure vector, v, can onLy assume a known direction 
and value. This assumption eliminates the need for estimation of v. 
Substituting v - u () , wince is the known vector. In equation (2-38) 

results in 


k 

2 In A(k) = 2vJ ^ (J , t ) v" 1 ( j ) r ( j ) - 

J = 1 


X 


~ k 

G[(j,t)V _1 G i (j,t) v Q 


(2-45) 


or 

2 In A(k) = 2 vjD t (k,t) - v^C^k, t)v Q . (2-46) 

The time of the failure, t, in equation (2-46) is unknown and it must 
be estimated. Maximization of 2 In A(k) in equation (2-46) with re- 
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sped to t can be expressed as 

L*(k,t) - Max j^vJjD^k.t) - VgC^k.Ovgj (2-47) 

t 

The restrictions imposed on failure directions will make the detection 
scheme more responsive to the predetermined directions and less sensi- 
tive to the nonspecified directions. As a result, these restrictions 
may only be useful if sufficient information about the nature of the 
failures in the system is available. The development of the GLR for the 
two simplifications suggested in reference 1 concludes the study of GLR 
for time-varying system. 

In summary, three types of failures, namely the hard-over actua- 
tor failure, brief disturbance in the actuator, and the hard-over sen- 
sor failure, were considered. Examination of the results generated for 
these failures indicates that the Generalized Likelihood Ratio indices 
for the three types of failure can be expressed in a common form as: 

L i (k,t) - D* (k,t)C^ 1 (k,t)D i (k,t) for i - 1,2,3 (2-4d) 

where D^(k,t) and C^k.t) are defined in equotions (2-35) and (2-36), 
respectively. The source of distinction between D^(k,t)'s and 
C^(k,t)'s for the three types of failure is the different G^(k,t) ma- 
trices. The matrix G^k.t) reflects the effect of type i failure on 
the residuals. Therefore, the successful detection and isolation of a 
failure depends on how well the G^(k,t) matrix represents the true ef- 
fect of type i failure on the residuals. A summary of the GLR form- 
ulation for the three types of failures is given in Table 2.1. A de- 
sign regarding the occurrence and the type of a failure is made as 
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TABLE 2.1 

SUMMARY OF GLR FORMULATION FOR TIME -VARY INC SYSTEMS 


GLR Index 


L i (k,t) - D^(k,t)C^ 1 (k,t)D 1 (k,t) 


D 1 (k,t) 


I 

j-1 


G^(j,t)v" 1 (j)r(j) 


Hard-Over Actuator 
(state step) 


Brief Disturbance 
in the Actuator 
(state jump) 

Hard-Over Sensor 
(sensor step) 


k 

C i (k » t) * Yj C I<J* t ) V ’ 1 <J)G 1 (J.t) 
j-1 

For i * 1,2,3 


r k 

H Y Q(k,t) k >_ t 
j-t 

Gj (k, t) * < 


|^0 k < t 


C 2 (k,t) 


HQ ( k , t ) 

.0 


k >_ t 
k < t 


C 3 (k,t) 



k t 
k < t 
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follows. The L^(k,t) from equation (2-41) is compared with a threshold 
* * 

i and If L^(k,t) exceeds c then the occurrence of a failure of type 
i at time t is declared. When more than one type of failure is 
considered then the selection of the failure type is achieved by maxi- 
raizing L^k.t) over i, the type of the failurs. The procedure for 
selecting e is given in the next chapter. Due to the importance of 
time- invariant systems in practical applications, the next section is de- 
voted to the discussion of the GLR failure detection for these systems. 
2.4 Application of GLR to Time- Invariant Systems 

The development of GLR detection technique for time-invariant sys- 
tems Is indeed a special case of the time-varying formulation of the 
technique. The importance of studying failure detection for time- 
invariant systems stems from the fact that in most practical applica- 
tions the systems are assumed to be t ime- invar ian t . As in the time- 
varying case, the first step is to develop the system model. 

2.4.1 The S y stem Model 

The state and output equations for a time-invariant system can be 
written as: 

X(k + 1) « <fi X ( k) + BU (k) + F (k,t) (2-49) 

a 

Z(k) - HX(k) + JU(k) + Y(k) + F (k,t) (2-50) 

B 

where all the symbols are defined in the same way as in equations (2-1) 
and (2-2) except that <f» , B, H, and J are not functions of k any 
longer. The failure functions F (k,t) and F (k,t) are used to model 
the three types of failure in exactly the same manner as in equations 
(2-3) through (2-7). The next step is to model the effect of the fail- 
ures on the residuals of the time- invariant system. 



2.4.2 The Residual Model 
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The definitions and the assumptions of Section 2.3.2 regarding the 
modeling of the residuals also apply to time-invariant systems. How- 
ever, the matrices $ and H are constant and this simplifies the for 
mulation of the G^k.t) matrix. The effect of each type of failure on 
the residuals of t ime- invar iant systems will be developed as follows. 

1. Hard-Over Actuator (State Step) Failure 

The change in the value of the states due to a hard-over actuator 
failure can be calculated from the following equation: 


X 2 (k + 1) - cf>X 2 (k) + o fc+1 v (2-51) 

X 2 (k) - 0 for k < t 

where <p , , v, and X 2 (k) are defined in the same way as in equa- 

tions (2-1), (2-3), and (2-10), respectively. The closed form solution 
for equation (2-51) is as follows: 


X 2 (k) 


r k 

Q(k,t)v 

j=t 




k > t 


(2-52) 


^0 k < t 


where Q(k,t) is the discrete tran- _tion matrix obtained by solving 
equation (2-51). Specifically 


Q(k,j) = 




(2-53) 


The equation (2-52) can also be derived directly from equation (2-15) 
by substituting <p for $ (k) , <f> (k - 1) , . . . etc. The effect of the 
failure on the residuals can be calculated by multiplying X 2 (k) by H: 
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H £ ^ k_J v 


k > t 


r 2 (k) -< 


J-t 


k < t 


V. 


(2-54) 


Using the notation introduced in equation (2-26) 


r 


(^(k.t) - < 


H £ ♦■‘-J 
J-t 


k > t 


k < t 


(2-55) 


The equation (2-55) indicates that is only a function of d « k - t 

which allows equation (2-55) to be rewritten as: 


G : (d) 



d > 0 


(-*56) 


^0 d < 0 


2. Brief Disturbance in Actuator 

The effect of a brief disturbance in the actuator on the states is 
evaluated from the following equation. 

X,(k + l) = *X 2 (k) + <5 k+1>t v. (2-57) 

The closed form solution for the above equation can be derived as: 
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X 2 (k) 


f Q(k.t) 



k ^ t 
k < t 
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(2-58) 


where 


Q(k,t) - * k t . 


(2-59) 


Therefore, the effect of the failure on the residuals can be written 
as : 



k >_ t 
k < t 


(2-60) 


The 


C 2 (k,t) corresponding to r 2 (k) = G 2 ^»t)v is 


HtJj 


k-t 


G 2 (k,t) - { 




k > t 


k < t 


( 2 - 61 ) 


It is easily seen that C 2 (k,t) may be written as a function of 
d = k - t : 



d >_ 0 
d < 0 


(2-62) 


3 . Hard-Over Sensor (Sensor Step) Failure 

Consider the effect of a hard-over sensor failure on the residuals 
in equation (3-21); 


r 2 (k,t) = a kjt y (2-53) 

It can easily be seen that the effect of a hard-over sensor failure on 
the residual is independent of the system equations. That is, the ef- 
fect of a sensor step failure on the residuals is the same for both 
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time- invariant and time-varying Bystem. Therefore, C^(k,t) correspond- 
ing to r^Ck) ■ G^(k,t)v can be written as: 


G 3 (k,t) - i 




k > t 


k < t 


Of P00', : : 


(2-64) 


or, alternatively, it can be expressed as 


r i 

< 

d >_ 0 

(2-65) 

w 0 

d < 0 



where d ■ k - t. With the completion of modeling the residuals, the 

GI.R for the time- invariant system will be derived. 

2 .4.3 The Generalized Likelihood Ratio 

Consider the derivation of the GLR for time-varying systems in 

equations (2-27) through (2-41). Direct substitution of G^(d) (from 

eqs. (2-56), (2-62), and (2-65)) into equations (2-27) through (2-41) 

/ ^.elds the corresponding GLR relationships for time- invariant system. 

A summary of these relationships for time- invariant systems is given in 

Table 2.2. Since G ’ s for the time- invariant system are functions of 

* 

d ■ k - t, C^'s will also be functions of d only. This is true since 
the covariance matrix of the residuals is constant (i.e., V(j) = V). 
Therefore, the for time- invariant systems can be derived from 

equation (2-35) by direct substitution of G^ (d) : 

d 

C i (d) = Yj G ^i) v " lG i(j) (2-66) 

j-0 

Although D i (k,t) remains a function of both k,t, it may be expressed 
in terms of d and t as follows. Consider the equation 
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TABLE 2.2 

SUMMARY OF GLR FORMULATION FOR TIME- INVARIANT SYSTEMS 
GLR Index L^d.t) = D^(d,t)C^(d)D(d,t) 

d 

D i (d,t) " Y G I<j )V " lr( j + 

j-0 

d 

c i (d) " Y 1 g i ( j ) 

J-0 


Hard-Over Actuator 
(state step) 


d ■ k - t 


G 1 (d) 



d > 0 


Brief Disturbance 
in the Actuator 
(state jump) 

Hard-Over Sense 
(sensor step) 


I 0 d < 0 



d 1 0 
d < 0 


c 3 <d) - 



d >_ 0 
d < 0 
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D l (k, t ) - ]T G^( j - nv _1 r(J). (2-67) 

J-l 

Since 

G (j - t) ■ 0 for j < t 

then 

d 

D i (d,t) - Yj G iO) v ~ lr <J + t) (2-68) 

J-0 

where d - k - t. 

The derivation of GLR relationships for time- invariant systems is 
of considerable significance for practical implementation of the tech- 
nique. In a typical jet engine application the relationships in Table 
2.2 will be implemented on a digital computer. Two observations can be 
made in this regard. The first observation is that for time-invariant 
systems G^(d) and C^(d) (see Table 2.2) are only functions of 
d * k - t (where k is the number of the current observation and t is 
the time of the failure), therefore, they can be computed off line for 
on-board utilization. This property is important when storage and com- 
putation cycle cime are critical. The second observation that can be 
made is that the GLR relationships resulting from the proposed detection 
scheme (Fig. 2.2) can easily be written in a recursive format. The re- 
cursion relationships yield a simple procedure for computing GLR indi- 
ces. The development of these recursion relationships is the subject 
of the next section. 

2.5 Recursion GLR Relationships for Time- Invariant Systems 


In this section a set of recursion relationships for calculation 
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of the GLR detection index for the time-invariant systems is developed. 
The main utility of these relations is to facilitate the computer pro- 
gramming of the proposed GLR detection scheme. Consider the GLR equa- 
tions for time- invariant systems in Table 2.2. In order to calculate 

the GLR index, L^(d,t), it is essential to compute C^(d) and D^(d,t) 

T -1 

first. The matrix C^(d) is the summation of the matrices Cj(j)v (j ) , 
for j - l,2,...,d, hence, it can be written in the recursion format by 
inspection as follows: 


C i (d) - C t (d - 1) + G^(d)v" l G 1 (d). (2-69) 

Simularly the column vector D^(d,t) can be written as 

D i (d,t) - D A (d - l.t) + G^(d)V _1 r(t + d). (2-70) 

It follows from equations (2-69) and (2-70) that the computation of 
C^(d) and D^(d,t) depends directly on the G^(d) matrix. Therefore, 
the derivation of recursion relations for G^d) is necessary. The re- 
lations for each of the three types of failure will be developed. 

1. Hard-Over Actuator Failure 

For the hard-over actuator the G^(d) was derived in equation 
(2-50) as: 


C x (d) 


r d 

s=0 

< 


* 


d-s 


d > 0 


(2-71) 


|^0 d < 0 


From equation (2-71), for d >_ 0 the 


G 1 (d) = + $ d ' 1 + . . . + ij 


G^(d) can be written as: 


(2-72) 



or 
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G 1 (d) - h[i + ♦ + . . . + <* d ] 

thus 

d 

c i (d) " h £ * s * 

8"0 

It follows from equation (2-74) that 

d - 0 
d > 0 
d < 0 


C 1 (d) - S 


G < d - 1) + H<j> 


2. Brief Disturbance in Actuator 
Examination of the form of G 2 (d) in equation 
G^Cd) can be written as: 


d - 0 


G 2 (d) -< G 2 (d - 1)4. 

U 


d > 0 
d < 0 


The derivation of equation (2-76) is achieved in the 
G 2 (0) - H 

G 2 (l) * H* - G 2 (0)4> 

g 2 (2) - m 2 *= G 2 (l)4 


G 2 (d) - H4 d - G 2 (d - 1)4. 


(2-73) 


(2-74) 


(2-75) 


-62) indicates that 


(2-76) 


following manner 


( 2 - 77 ) 
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Equations (2-75) and (2-76) can be combined into one equation for calcu- 
lation of G^(d) as follows: 

G x (d) - G A (d - 1) + G 2 (d) d > 0. (2-78) 

Equation (2-78) implies that G^(d) is the cumulative sura of C„(d). 

This is, of course, expected because the G^(d) reflects the effect of 
a persistent actuator failure while C 2 (d) reflects the effect of the 
actuator failure over one sample interval. Another implication of equa- 
tion (2-78) is that after the C 2 (d) matrix is calculated the G^(d) ma- 
trices can be computed by simple matrix addition. 

3. Hard-Over Sensor 

Consider G^(d) in equation (2-65), this matrix is simply a g * g 
identity matrix for d >_ 0, i.e., G^(d) is a constant matrix for d > 0. 
Since G^(d) is a constant matrix C^(d) takes a simple form as 

d 

C 3 (d) - V _1 - (d + 1)V _1 d >_ 0 (2-79) 

j-o 

A summary of the recursion relationships for G^(d) is given in Table 
2.3. 

The development of the detection technique for hard failure is con- 
cluded at this point. The study of statistical properties of the detec- 
tion technique will be discussed in the next chapter. Prior to exami- 
nation of the statistical properties of GLR, a brief discussion of soft 
failures in sensors is presented in the next section. 

2.6 Sensor Soft Failure 

In this Section a failure detection technique for sensor soft fail- 
ures in time-invariant systems using the proposed detection scheme 
(Fig. 2.2) will be presented. The objective is to demonstrate the 



47 


ORIGINAL PAGE IS 
OF POOR QUALITY 


TABLE 2.3 

summary of recursion formulas for O^d) 

(Time-Invariant Case) 


Hard-Over Actuator 
(state step) 


G^d) 



d - 0 
d > 0 
d < 0 


or 


Gl (d) 



1) + c 2 (d) 


d « 0 
d > 0 
d < 0 


Brief Disturbance 
in the Actuator 
(state Jump) 
Hard-Over Sensor 
(sensor step) 


d - 0 

C 2 (d) " 1 C 2 (d " d > 0 
[o d < 0 


G 3 ( d ) 



d < 0 
d > 0 



A 8 

applicability of the proposed detection technique to the problem of soft 
failure . 

A sensor soft failure can be defined as an increase in the known 
variance of the sensor output. Figure 2.3 illustrates the definition of 
o sensor soft failure. In order to test a sensor for soft failure two 
hypotheses are set up 

H q : No failure has occurred 

(2-80) 

A sensor soft failure has occurred 

Testing of the above hypotheses is accomplished by utilizing the model 
residual. Several assumptions regarding the model residual are made. 

It is assumed that under no-failure hypothesis, Hq, the model residuals 
are zero mean white Gaussian noise with known constant variance, V. 

The second assumption is that when a failure occurs the variance matrix 
changes to some unknown matrix V* while the mean remains the same and 
the Gaussian and whiteness properties are retained. 

Based on the above assumptions the hypotheses in equation (2-80) 
can be expressed in terms of the variance of the residuals as 
H : Residual variance V (known) 

0 (2-81) 
H^; Residual variance V* (unknown) 

Both V and V* are diagonal and positive definite. The matrix V* 

has at least one element larger than the corresponding elements in V. 

To test the hypothesis in equation (2-81) the method of Generalized 

Likelihood Ratio will be used. For this purpose consider the likelihood 

function for hypothesis H^: 

l Q “ Prob. [r(l),r(2),...,r(k)/H 0 ] (2-82) 


or 
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(2it ) 


-gk/2 | -k/2 


exp 


\ Yj r T <J)v” 1 r(J) 

J-l 


(2- 83) 


where L Q is the probability that the k observations of the model re- 
siduals are from a population with Ga'issian distribution and covariance 
matrix V, and g is the dimension of the residual vector r(J). Sim- 
ilarly the likelihood function for alternate hypothesis, H^, can be 
written as 

L x - Prob. [r(l),r(2) r(k)/H^ (2-84) 


or 


L 


1 


( 27 r ) _gk/2 | v *!‘ k/2 




r T (j)V* _1 r(j) 


(2-85) 


where is the probability that k model residuals, r(j), are from 
a population with Gaussian distribution and unknown variance V*. The 
likelihood ratio for Hq and can be written as 


L 



( 2 - 86 ) 


taking the logarithm of both sides of equation (2-76) yields: 

log L = log - log Lq . (2-87) 

Before substituting for and L_ from equations (2-83) and (2-85) 

into equation (2-87), the following definitions are adopted. 


s i 4 V ' 1 


(2-88) 


and 
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S 2 4, V*' 1 . (2-89) 

Using the above definitions the determinants of and S 2 can be ex- 

pressed in terms of | V J and |v*| as follows 

|sj - jvf 1 (2-90) 

and 

|S 2 [ - 1 V*| _1 . (2-91) 

Now using equations (2-83) through (2-91), equation (2-87) can be re- 
written as: 


k 

Log L - | log|S 2 | - ~ V r 1 (j)S 2 r(j) - j k loglsj 

J-l 

k 

+ 2 2 r ' :(J)S l r(J) ' (2 ' 92) 

j*l 


Since V* is unknown, then it. must be estimated before log L can be 
evaluated. This is accomplished by maximizing log L with respect to 
S 2 (see Appendix C). This results in 


S 


2 



(2-93) 


Prior to substitution of equation (2-93) Into equation (2-92) it is ad- 
vantageous to use the following equivalent form: 


r T (j)S 2 r(j) - Ti 

j-l 


S 2 Yj r(J)rT(J) 

L j-i 


(2-94) 
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in equation (2-92) and then substitute for S 2 » this yields 

k 

L(k) “ 2 log L * -k log | S 1 1 - k log r(j)r r (j) 

J-l 

k 

+ TrS 1 ^ r (J )r T (j ) - kg + k log k . (2-95) 

J-l 

Anderson (Ref. 5) shows that under null hypothesis the ratio in equa- 
tion (2-93) follows an asymptotic central chi-square distribution with 
g(g + 1 ) / 2 degrees of freedom. That is , as k -*• ® the distribution 
of L(k) approaches a chi-squared with g(g + 1 ) / 2 degrees of freedom. 
Based on the knowledge of the distribution of L(k) a threshold c can 
be selected and if L(k) exceeds this threshold then a soft failure is 
declared. The selection of e is accomplished by assigning a small 
probability a to the event of rejecting the true null hypothesis 
(type I error). 

The above development does not provide any information regarding 
the failure time. If the knowledge of the failure time is needed, the 
formulation in equation (2-92) can be modified to furnish such infor- 
mation. For this purpose, note that V* - V before a failure occurs 
at time t then equation (2-92) ran be modified as 

k 

log L ° ^ log) S 2 1 + logjsj - - r(j)S 2 r r (j) 

j«t 

k 

+ 2 Z r <i> S 1 r0) • 

J-t 


(2-96) 
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The estimate of in this case becomes 


S 2 * (k - 1 ) 


£ r(J)r T (j). 

L^“ t 


-i 


(2-97) 


Utilizing equation (2-94) and substituting S for S (from eq. (2-97)) 

z 2 

in equation (2-96) yields 


L (k) - 2 log L “ (-k + t ) log ( ( - (k - t)log 


£ rO)r T (J) 
3-t 


+ TrS 1 r(j)r 7 (j) - (k - t)g + (k - t)log(k - t). (2-98) 

J-t 


In equation (2-98) the time of the failure, t, is unknown, hence, it has 
to be estimated before L(k) can be computed. Again, by maximizing 
L(k) with respect to t , an estimate of failure time is calculated that 
can be used in calculation of L(k). Maximization of L(k) with respect 
to t requires computation of L(k) in equation (2-98) for each pos- 
sible value of t. It follows then that the burden of computation will 
grow rapidly as the number of observations grows. To circumvent this, 
an interval can be selected to restrict t as k-M<^t<^k-N 
where M,N are the limits of the interval. In selecting these limits, 
consideration should be given to the fact that only the asymptotic dis- 
tribution of L(k) is known. Hence, M should be selected such that the 
number of observations used in computing L(k) will be sufficiently 
large. 

The brief development of a soft failure detection procedure in 
this Section indicates that the proposed detection scheme (illustrated 
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in Fig. 2.2) can also be utilized for soft failure detection. A full 
treatment of soft failure analysis is beyond the scope of this disserta- 
tion, however, the development in this section can serve as a basis for 
future research in this area. To conclude this chapter, a summary and 
discussion of the results developed in this chapter is given in the next 
section. 

2.7 Summary and Discussion 

The problem of detecting a hard failure in a linear dynamic system 
was addressed in this chapter. A new failure detection scheme was pro- 
posed (Section 2.2) that is applicable to both linear time-varying and 
time- invariant systems. The proposed method is based on testing the re- 
siduals of a system model. The basic underlying assumptions of the pro- 
posed method are that when no failure exists in the system the model re- 
sidual is zero mean white Gaussian noise process and when a failure 
occurs the mean of the residual will deviate from zero while the Gaussian 
property is retained. Therefore, detecting a deviation in the mean value 
of the residuals is equivalent to detecting a failure in the system. To 
test the residuals, three modes of failure, namely hard-over actuator, 
brief disturbancs in the actuator, and hard-over sensor failures are con- 
sidered. Three pairs of hypotheses corresponding to these modes of fail- 
ure are formed and in each case the null and the alternate hypotheses are 
assigned to a no-failure and a failure mode, respectively. The null hy- 
pothesis is tested against the alternate hypothesis by forming the ratio 
of the corresponding likelihood functions (eq. (2-32)). This yields a 
scalar function (referred to as GLR index). A decision regarding the 
occurrence of a failure is made by comparing the GLR index with a thres- 
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hold e. If the GLR index exceeds c then u failure is declared. The 
type of the failure can be identified by selecting the type corresponding 
to the maximum value of the GLR indices. The estimate of the time of the 
failure is chosen as the failure time resulting in the maximum value of 
GLR indices. The failure vector, v, can be estimated (eq. (2-37)) by 

A A 

utilizing the C^Oc.t) and D^(k,t) matrices corresponding to the detec- 
ted type of failure i and the estimated time of failure t. 

The computation of the GLR indices is simplified by assuming that 
the linear system under study is time- invariant . This is the case in 
most of the practical applications. The simplifications are due to the 
fact that for time-invariant systems G^(d) is dependent on d = k - t 
only and, hence, C^(d) is also a function of d only. This property 
of G^(d) and C^(d) also allows the off-line computation of these ma- 
trices. In situations, such as a jet engine application, where the 
computation time is critical, G^,(d) and C^(d) can be computed off-line 
and stored for on-board utilization. In those cases where on-line cal- 
culation is possible the recursion relations for calculation of G^(d) 
simplify the computation of (d) and ultimately L^(d,t) (see Table 
2.3). 

It follows from the above discussion that the proper detection of 
a failure depends on the value of the threshold e. The procedure for 
selection of e will be discussed in the next chapter. Also in the 
next chapter various statistical and computational properties of the 
proposed detection plan will be discussed. This will Include topics 
such as the probability of correct detection, false alarm, wrong-time 
detection, and detectability of a failure. 



55 


The concept of GLR can also be applieJ to the problem of soft fail- 
ure detection in time- Invariant systems. Similar to the case of hard 
failure, the GLR decision rule is corner !r ;ed of comparing thi likelihood 
ratio with a threshold, e. The threshold e is selected based on the 
probability of type I error. In conclusion, the derivation of the GLR 
technique using model residuals for sensor soft failure in this chapter 
demonstrates the applicability of the proposed detection plan (Fig. 2.2) 
to the problem of soft failure. Further development in this area is 
needed and the results of this chapter can serve as a basis for such 
efforts. 



CHAPTER III 


STATISTICAL ANALYSIS OF DETECTION TECHNIQUE 
3.1 Introduction 

The proposed Generalized Likelihood Ratio (GLR) failure detection 
decision rule, developed Jn Chapter II, requires a comparison of the 
GLR index (eq. (2-41)) with a threshold e. In order to select a 
proper threshold c, various detection probabilities such as proba- 
bility of correct failure, false alarm, etc. should be determined. 

In this chapter these probabilities are developed. The derivation 
of these probabilities parallels the work of Chow in reference 3. 

The main difference between the results in this chapter and those of 
reference 3 is that the derivations in this chapter are based on using 
a plant model rather than the Kalman-Bucy filter in the detection 
scheme . 

The organization of the materials presented in this chapter is 
as follows. The probability distribution of the GLR index is 
developed in the next section. After the probability distribution of 
GLR index is identified, the proper level of threshold e can be 
established by examining the detection probabilities. These include 
the probability of correct detection, false alarm, cross detection, 
and wrong time which are derived in Sections 3.3 and 3.4. Following 
the derivation of the detection probabilities the question of failure 
detectability is addressed in Sec ion 3.5. In Section 3.6 the asymptot- 
ic behavior of C^(d) (eq . (2-66)) is studied to determine the effect 
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of the number of observ.it Ions on the detectability of failures. 

Finally, in Section A. 6 a summary and discussion of the results of this 
chapter is presented. 

3.2 Probability Distribution of GLR 

In the first part of this section the probability distribution for 
the GLR is derived without restricting the direction of the failure 
vector, v. In Section 3.2.1, the failure vector is restricted to a 
single vector Vg and the distribution of the simplified GLR is 
derived. To develop the GLR distribution in a general form, assume 
that a GLR detector hypothesizes the occurrence of a type i failure 
at time t^ while actually a type j failure has occurred at time t ^ . 
Since a type j failure has occurred the residuals are given by 

r(k) - r x (k) + G (k.tjjv (3-D 

where k is the observation number, tj is the time of the failure, 
r^(k) is a ::ero mean white Gaussian noise process, Gj(k,t^) reflects 
the effect of type j failure on the residual, and v is the failure 
vector. The GLR index was given in equation (2-48) as 

L(k,t i ) - D[ /j (k,t i )c' 1 (k,t i )D i/j (k,t i ) (3-2) 

where C^Ck.t^) is the same as in equation (2-35) and D^j(k,t^) is 
given by 

k 

U i/j* k,t i^ = S | (m * t j ) V 1 (m) r (m) (3-3) 

m-t^ 

In equation (3-3) V(m) is the covariance matrix of the residual of 
equation (3-1) and the subscript of D^Ck.t^) denotes the occurrence 
of type j failure while type i is hypothesized. To simplify the 
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presentation of mathematical relations in this chapter the following 
notation is adopted 


C i/j (k.ti/tj) - z G^(m,t i )v' 1 (m)G j (m.t^) 


(3-4) 


m*t 


Hence, for i = .1 and ^ “ t^ : 


ft. 

c i/i (k ’ t i /t i ) " M ILs G^ (m,t 1 )v" 1 (m)G 1 (m,t i ) (3-5) 

m**t^ 

which is the same as (2-35) . 

Consider C (k,^) in (3-5). Since V ^m) is positive definite and 
symmetric then C^(k,t^) is also symmetric and positive semidef inite . 
Therefore, C^(k,t^) can be transformed to a diagonal matrix by a 
similarity transformation as follows: 

A i/i (k ’ t i /t i ) " s" 1 C 1 (k,t 1 )S (3-6) 

where S is an orthonormal matrix and A^^k.t^t^ is a diagonal 
matrix with eigenvalues of C^(k,t^) as its elements. Utilizing 
equation (3-6) the GLR index in equation (3-2) can be written as 


L i^ k,t i' = h i/j^ k,t i^ A 1 (k.t 1 /t i )h i/J (k,t i ) 


(3-7) 


where 


h i/j (k,t i^ = S D i/j 


(3-8) 


In order to determine the distribution of L^(k,t^) it is necessary to 


identify the distribution of the random vector h^Ck.t^). The 
vector in ( 3_ 8) is a Gaussian random vector and it c£ 
be completely identified by its mean and variance. The mean of 
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hi/j(k,ti> can be computed as: 


E [ h l/J (k > t l>] • sT E [V) (k ’ t l ) ] 


ORIGWAL C 
OF POOR QUALITY 


(3-9) 


substituting for D jyj(k»t^) from (3-3) and taking the expectation 


yields 


tv 

E t'i/ j ( k * t ± ^J " S T ^ Gj(m,t 1 )v' 1 (m)G J (m,t J 


)v 


(3-10) 


m«t , 


Now using the notation introduced in (3-4), equation (3~10) can be 
written as 

,T 


F [h^k.t,)] “ S‘C 1/j (k,t i /t j )v 


(3-11) 


The covariance of <k, can be calculated in the following 


manner : 


E [ h ±/J Ck.tt) h I /j < k ' t 1 >] ‘ sTe - 


E G i < ”’ t i ) 


m»t J 


x V *"(m)r(m) 


-i ? 


E °I (m ’ c i 


)V* 1 (m)r (m) 


m-tj 


>S (3-12) 


Substituting for r(m) from (3-1) and taking the expected value 
results in 


E |h ±/j (k,t i )h^ /j (k,t i )J = S T C i (k,t i )S 


+ E [‘l/J »•»!)] E [*i/J (k - t l ) ! 


( 3 - 13 ) 



ORIGIUA- 1- v 

60 OF POOR QUALITY 


The first term on the right-hand aide of equation (3-13) is 
^i/f (k^i/tf) (see eq. (3-6)), hence the variance of h^Ck,^) 

is equal to A 1 / 1 ( k » t i /t 1 ) . Since ^^(k,^/^) is a diagonal matrix 
it follows that the elements of ^i/j^ k,t i^ are l n d e P en dent of one 
another. 

Consider the GLR index in equation (3-7), the expression for 
GLR index can be written as: 


8 h^(k,t ,) 


E ll '.•v.w . 

A ~ 

q-1 


(3-14) 


where h (k,t.) and X are qth elements of h ,.(k,t ) vector and 
q i q l/j i 

Ai/i(k, t i/ t i) matr ^ x respectively, and g is the number of system 

outputs. Examination of (3-14) reveals that L^(k,t^) is the sum of 

squares of the Gaussian random variables with mean of 

h (k, t . )/%f\ , where h (k,t.) is the mean of the qth element of the 
q i / y q q 1 




X is unity because 

q 


h. ,.(k,t.) vector. The variance of h (k 
i/j i q 

X is the variance of h (k,t,). Since the elements of h. , (k r t.) 
q q i -r/J 1 

are independent of one another with a Gaussian distribution, then the 

GLR index has a noncentral chi-squared distribution with g degrees 

2 

of freedom and noncentrality parameter 6 given by 

2 V^i* 


£ 

q=*l 


(3-15) 


(Ref. 61). It is useful to write d in matrix form for the calcula- 
tion of detection probabilities which will be presented later. 


Specifically, 
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A* - 


V 1(1 1/ | ^ k,t l^ 1 )) S A i/1 * k ' l l ^ I 


Using the orthonormal property ot matrix 
(3-16) can be written as 


T T 

- V C 


1 /j(k , t J /tj) c 1 / i ( k » t i / t 1 ) 


> S ' C l/| (k,t l /t J ) V °~ l6) 
T -1 

S, i.e., S*S equation 


C i/J (k * t i / t j ) v (3-17) 


This concludes the derivation of the probability distribution for the 
GLR index. Since no assumption regarding liJtt^.tj and v was made, 
various probabilities regarding failure detection can be computed as 
special cases of the general derivation of this Section. One special 
case of interest is to restrict the failure vector to a single known 
vector, v i.e., the case of Simplified GLR. For this case the 
distribution of the SCLR index is a Gaussian distribution and its 
derivation is presented in the next Section. 

3.2.1 Probability Distribution of Simplified GLR 

Consider the Simplified Generalized Likelihood Ratio (SGLR) 
index in equation (2-46). If an SGLR detector hypothesizes the 
occurrence of a type i failure at time t^ while a type j 
failure has actually occurred at time t^ the equation (2-46) can 
be rewritten as 


L(k,t 1 ) - 


2v; 


Z 

m*l 


X c j( ».t ) 



1 


k 

G l (m,t 1 )V -1 (m)r 1 (m) 


Z G I 


J 


_m* 1 


“ k 


1 

T 

V - v 0 

^ G*(m,t 

j_> V~ 1 G i (m, t^) 


_m»i 


J 


-1 


V Q (3-18) 
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The equation (1-18) lollowa directly from (2-46) by substituting fur 
r(m) from equation ('3-1), Since r^(m) In (3-18) Is a white Gaussian 
noise process then L(k,t^) is a sum of independent Gaussian random 
variables. Thus, the probability distribution of L(k,tj) for SGLR iB 
Gaussian. The mean of L(k,t^) is given by 


[uk.t^J 


2v 


^ G|(m,t 1 )v" 1 (m)G j (m,t j ; 


m»l 


- v. 


^ G^(m,t i )V~ 1 G 1 (m,t 1 ) 


m«l 


(3-19) 


Using the notation introduced in (3-4), equation (3-19) becomes 

E [ L (k ,t: i)] “ 2v i C i/j (k * c i /c j> v " v 0 C i^ k,r i^ V 0 (3-20) 

The variance of L(k,t^) can be calculated as follows: 


E juk.t^ - E [L(k,t i )] 


4v 


2 

m“l 


G^(m,t i )V 1 (m) 


x G 1 (ra,t 1 ) 


v Q (3-21) 


or 


E ^L(k,t i ) - E J^L(k, t ± ) 


- 4vJ C i (k,t i )v () 


(3-22) 


This concludes the derivation ol the distribution of the SGLR index. 
Next, the distribution of the GLR and the SGLR indicies will be 
utilized to determine four important detection probabilities, namely, 
the probability of correct detection, false alarm, cross detection, 
and wrong time failure. 



3 . 3 Detection Probabilities 

Based on the GLR decision rule, established in Section 2.3.3, if 
a GLR Index corresponding to a type i fuilure exceeds a selected 
threshold > then a failure is declared. It is possible, however, 
that the GLR index corresponding to a failure of type i exceeds 
the threshold i while a failure of type J has actually occurred. 

It is, therefore, essential to establish the probability for various 
detection modes. Four important detection modes are correct 
detection, false alarm, cross detection, and wrong time. 

Probability of Correct Detection 

The probability of correct detection is a measure of reliability 
of the detection technique. It can be defined as: 

P (k,i,t,v) £ Prob. (L 1 (k,t) > e/i,t,v) (3-23) 

that is the probability that the GLR index, L^Ck.t), for a type i 
failure at time t exceeds the threshold e given that a failure v 
of type i has actually occurred at time t. This probability can 
be computed f v om the distribution of the GLR index which was 
developed in Section 3.2. For the case of correct detection the 
noncentrality parameter 6 (eq. (2-17)) for the GLR distribu- 
tion is given by 

6 2 ■= v T C (k,t)v. (3-24) 

Equation (3-24) is derived from equation (3-17) by substituting 
i - j and t^ = t^ and using the notation defined in (3-5). 

False Alarm 

The false alarm probability indicates the consistency of the 


detector. It is the probability that the GLR index exceeds a 
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threshold c given that no failure has occurred. Expressing this 
definition in symbols yields: 

P F (k,l,t)r Prob.(L 1 (k,t) >e/v-0) (3-25) 

2 

The noncentrality oarameter 6 (eq. (3-17)) for this case is zero 
because v»0. Thus, the distribution of the GLR index for this case 
is a central chi-squared with g degrees of freedom. 

Cross Detection 

The probability of cross detection provides a measure of the 
capability of the GLR technique in selecting the true type of failure. 
The probability of cross-detection can be defined as: 

Pr ° b ' .t» y ) (3-26) 

which is the probability that GLR index for type i failure will 
exceed the threshold c while a failure v of type j has actually 
occurred. The noncentrality parameter for probability distribution of 
L^(k,t) for this case (from eq . (3-17)) is given by 

6^ - (k,t/t)C^(k,t)Cjyj (k,t/t)v (3-27) 

since i^1 and t,“t *t. 

i j 

Wrong Time 

Correct estimation of the failure time is important for two rea- 
sons. First, the estimate of the failure vector is directly dependent 
on the estimate of the failure time. The second reason is that the es- 
timate of failure time is often required when using the variable ac- 
commodation technique. The probability of wrong time detection is de- 
fined as the probability that the GLR index of type i failure at 
time t exceeds the threshold c given that the failure has actually 


£ 


65 


occurred at t Line t . This can be expressed In mathematical symbols 
us : 


I’ (k,l,t,v,t )» I’rob . (L (k , t )>e / I , t , v) (3-28) 

W 1 1 c 

Using equation (J--28) the noncentrality parameter for GLR probability 

distribution in this case Is given by 

(3-29) 


<r - v l c 1 / 1 (k,t/t c> )c 1 1 (k,t)c l/ 1 (k,t/t { .)v 


since i»J and t**t . A summary of the above results for the four 
detection probabilities is presented in Table 3.1. 

Derivation of the four detection probabilities for simplified GLR 
follows the same procedure as above. In the case of SGLR, however , 
the d latr Ibutftfh of the SGLR index is Gaussian and instead of the non- 
centrality parameter, the mean and the variance of the distribution 
should be determined for each of the four cases. The variance of 
the Gaussian distribution for all four modes remains constant (see 
eq. (3-22)) while the mean varies. In the case of correct detection 
i«l, t“t, and v»v,, the mean becomes 

i J 0 


E [ L i (k - t t>] - 'o <: i <k ' t l )v 0 (3 - 

The above procedure repeats for the remaining three modes and a 
summary of the corresponding means is given in Table 3.2. The 
development of the detection probabilities in this section has been 
for time varying systems. In the next section the detection proba- 
bilities for the special case of t line -invariant systems will be 
d iscussi’d . 

3 . U Failure Detection Probabilities for Time-Invariant Systems 


In many practical applications of control theory the system 
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TABLE 3.1 

SUMMARY OF NONCENTRALITY PARAMETERS 
FOR FOUR DETECTION MODES 


Correct Detection: 

6 2 - v T C i (k,t 1 )v 
Remarks: i-j and t i" t j 

False Alarm: 

<5 2 - 0 

Remarks: v=“0 and i“j 

Central chi-squared distribution for GLR 

Cross Detection: 

6 2 “ v T C i/j (k,t/t)c" 1 (k,t)C i/j (k,t/t)v 
Remarks: t^“tj=t 

Wrong Time: 

6 2 = v T C i ^ i (k,t/t c )C i 1 (k,t)C i ^ i (k,t/t c )v 
Remarks: 1=1 and t^t 

c 

Also t<t <k or t <t<k 
c c 
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TABLE 3.2 

SUMMARY OF SGLR GAUSSIAN DISTRIBUTION MEANS 
FOR FOUR MODES OF DETECTION 

Correct Detection: 

T 

Mean * v Q C i (k, tj )\> 0 
Remarks: i“j and v“Vq 

False Alarm: 

T 

Mean - - v o C l *"1^0 
Remarks: l“j and v“0 
Cross Detection: 

Mean = 2v o C i/j *1^1^ - v^C i (k,t 1 )v () 

Remarks: and tj*tj 

Wrong Time: 

Mean - ZvJc^Ck, t^/t^Vg - vJc^k.OVg 

Remarks: t ^ t c * » an( ^ v^Vq 

t<t <k or t <t<k 
c c 


Also 
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under study is assumed to be time- invariant . It is, therefore, impor- 
tant to study the prolability of various modes of detection, namely, 
correct detection, false alarm, cross detection, and wrong time for such 
systems. In this sect.' 1 on detection probabilities are developed for the 
three types of failure which were discussed in Chapter 2. The key ele- 
ments in establishing these probabilities are the corresponding non- 

2 

centrality parameters. Therefore >5 of the four detection probabili- 
ties are derived for each of the three failure types. Before proceding 
with the derivation, it should be noted that in case of false alarm the 
probability distribution of the GLR index reduces to central chi- 
squared, thus the corresponding noncentrality parameter is zero for all 
three failure types. 

3.6.1 State-Step Failure 

Consider the general formulation of the noncentrality parameter 
for correct detection, given in equation (3-24). The C^k.t) for a 
state-step failure for the time- invariant system is given by 


C i (k,t) 


d 


m=0 


m 

T 

m 

H V 

L-J 

v" 1 

H £ 

_ x=0 _ 


- k=0 


(3-31) 


where d = k - t. The equation (3-31) is derived by substituting equa- 
tion (2-56) in the expression for C^(d) in equation (2-66). Now by 

substituting equation (3-31) in equation (3-24) the noncentrality para- 
2 

meter <5 for this car becomes 
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r d 




\ ' r m 

T 

“ m 


) z**- 10 

(hV^) 


> 

/ J U-0 


— 1 

0 

1 

_*] 


m“0 



> 


(3-32) 


The noncentrality parameter for cross detection is given in its 
general form in equation (3-27). The C^^t/t) for state-step fail- 
ure is given by 


C 1/;] (k, t/t) - 


m 

x-0 


-iT 


(m-x) 


H T V _1 Gj (m) 


(3-33) 


m«0 

where d » k - t. Equation (3-33) is the direct result of substituting 

equation (2-55) into equation (. -4). The matrix C ± (k t t) is given by 

2 

equation (3-31). Hence the 6 for cross detection can be written as 


r d 


T 


m 


) 


H T V -1 Gj ( m) 

L j 

jc=0 


m=>0 




r d 


HP 



\y 

” m 

T 

(H T V _1 H) 

m 

> 

V. m=0 

_x=0 __ 


_x=0 _ 

J 


r d 



■s 


~ m 

- 

T 

Z 

z 

J£«0 

(f) ( m-x ) 

H T v" 1 G j ( m) > 

v. m=0 



J 


(3-34) 
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l'ho nonront rality parameter lor wrong time dot or t ion can bo de-ivod 
from the general equation for this modo ot talluiv In equation ( t- :;n) . 
Utilizing equation (2-55), c ^/j t / t c ) 1 - or «iate-step failure yields 


C 


i/j 


(k,t/t c ) 



m=t 


(3-35) 


2 

and C^(k,t) remains the same as in equation (3-31). Thus 6 for 
wrong time detection for state-step failure becomes 




(_m=t 





(H 1 V _1 H) 

“ m — 

Yj * (m " X) 

> 


*-t _ 

J 


(3-36) 


This concludes the derivation of noncentrality parameter for state-step 
failures. The equations (3-32), (3-34), and (3-36) provide the necessary 
information for evaluating the performance of a GLR detector set to de- 
tect state-step failures in a time- invariant system. Specifically, 
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equation (3-32) provides a measure of detectability of failures as for 

2 

a constant threshold e, larger <5 results in higher probability of 

2 

correct detection. Similarly, the equations (3-34) and (3-36) for 6 
enable one to compute the probabilities of cross detection and wrong 
time detection, respectively. Next the noncentrality parameters for 
state-jump failure will be developed. 

3. 4. 2 State-Jump Failure 

The noncentrality parameter for correct detection of this failure 

2 

mode can be calculated from the general form of 6 in equation (3-24). 
The C i (k,t) in equation (3-24) for state-jump failure becomes 

d T 

C i (k » t) “ X ( 4>m ) ( HTv ' lH H m 0-37) 

m *-0 


where d ■ k - t. Equation (3-37) is derived by substitution from equa- 
tion (2-62) into the equation for C^(d) given in equation (2-66). Now 
substituting equation (3-37) in equation (3-24) yields 6 for state- 
jump failure as: 



(3-38) 


The derivation of the noncentrality parameter for cross detection 
of state-jump failures can be accomplished by substituting the corre- 
sponding expressions for (^^(k.t/t) an( j c^(k,t) for this mode of 
failure in equation (3-27). The expression for C^(k,t) is given in 
equation (3-37) and C^^(k,t/t) can be calculated by substituting 
G^tm) from equation (2-62) into equation (3-4) which yields 
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c i/j (d > - I (♦"/ hV S 


(m) 


(3-39) 


m-0 


Hence <S for cross detection can be written as 


.2 T 
6 *v 


-T 


]T (*“) hV-VjOd) 


L®*o 


^ (* ra ) 


m-0 


-1 


^ (♦“) H T V _1 HGj (m) 


m M 0 


(3-40) 


The calculation of 6 Z for wrong-time detection is accomplished 
by substituting proper values of (^^(k.t/t^ and C^k.t) in equa- 
tion (3-29). The expression for C^k.t) is given in equation (3-37) 
and Ck, t ^ t c ^ can be derived by substituting for G^(m,t) and 

Gi(m,t c ) in equation (3-4) from equation (2-61). Thus 


C i/i (k,t/t c > “ Z < hTv_1| «(* tc ) 


m«=t 


therefore 


(3-41) 


.2 T 
6 - v 


2 (♦ nr ’ t ) (H T v _1 H) (<t> c ) 


m=t 


r d 


-i-i 


^ (<fr m ) (h T v _1 h) (4> m ) 


m=0 


£ (hV^o (»"“') 


m=t 


x 


v 


(3-42) 
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This completes the derivation of the noncentrality parameters for state- 
jump failure. Equation (3-38) provides the essential information for 
calculation of the probability of correct detection when a failure has 
actually occurred. Similarly equations (3-40) and (3-42) give the nec- 
essary information for evaluating probabilities of cross detection and 
wrong-time detection, respectively. In the next section the noncen- 
trality parameters for sensor-step failure will be calculated. 

3. 4. 3 Sensor-Step Failure 

2 

The calculation of 6 for correct detection can be achieved by 
substituting for C^(k,t) in equation (3-24) from equation (2-79), 
which yields 


6 2 - (1 + d)v T V _1 v (3-43) 

where d ■ k - t. 

2 

For cross detection, 6 is calculated from equation (3-27) by sub- 
stituting tor C_^^(k,t/t) from the following expression 


Cjyj (k, t/t) 


“ d 

Y V _1 G (m) 
mrO 


(3-44) 


Equation (3-44) is derived by substituting equation (2-64) in equation 
(3-4). Hence 6 Z is given by 



“ d 

T 

“ d 

.2 T 

<5 »v 

Y V -1 G (m) 

( v ) 
\1 + d / 

Y v “ 1 G j (n>) 


_m“0 


_ra**0 


Finally 6 for wrong time failure can be derived from equation 

(3- 29) by substituting the following expression for C, ,.(k,t/t ) 

1/ 1 c 
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C l / t (k - t/t c ) 



(3-46) 


where a is a unit step function defined in equation (2-6). Equa- 

m, t 

c 

tion (3-66) is derived by substituting equation (2-66) into equation 


(3-4). The expression for C^(k,t) is the same us in equation (2-79). 

2 

Then 6 can be written as: 



(3-47) 


This concludes the derivation of the noncentrality parameters for the 
three modes of failure. The main utility of the relations developed in 
this section is to provide the necessary information for evaluation of 
reliability (correct detection) and consistency (false alarm) of the GLR 
detector, capability of selecting the true failure type, and correct es- 
timation of the failure time. To continue the study of the characteris- 
tics of the GLR detectors, the next section is devoted to the detecta- 
bility of failures. 

3.5 Failure Detectability 

In the course of development of any failure detection technique, 
it is essential to determine what failures can not be detected. The GLR 
technique utilizes the deviation of the residual mean from zero, in 
case of a failure, to detect various modes of failure. Therefore any 
failure which does not effect the mean of the residuals can not be de- 
tected. It follows that any failure in the unobservable space of the 
system under study can not be detected. An important question can be 



raised Immediately: 1 h It posBlblo to establish detectability condi- 

tions for the proposed GLR technique? 

To Investigate the answer to tills question consider the general 
expression for the CLR Index at kth observation 

L^k.t) - D^(k,t)C^ 1 (k,t)D 1 (k,t) (3-48) 

It can be seen from equation (3-48) that the calculation of L^k.t) 
depends on the invertlbillty of C^k.t) matrix. Although it is diffi- 
cult to establish the conditions for invertlbillty of Cj(k,t) in case 
of actuator failures, it is possible to show that C^(k,t) is always in- 
vertible for sensor failures. 

In order to establish invertlbillty of C^(k,t) for sensor fail- 
ures consider C^(k,t) for a sensor-step failure 

k 

C i (k» t ) - Yj v_1 (J) (3-49) 

j-1 

where V(j) is the covariance matrix of the model residual. According 
to the assumption that model residuals are white Gaussian noise pro- 
cesses then the matrix V(j) is a positive definite diagonal matrix. 
Therefore, V ^(j) is also positive definite. It can be shown that 
C (k,t) in equation (3-49) is also positive definite (see the proof in 
Appendix B). Hence, C^Ck.t) is always invertible which proves the; all 
sensor step failures are detectable. In the case of time-invariant 
systems the comii' o is of invertibility of C^(k,t) matrix can be es- 
tablished for actuator failures. Before proceeding to develop these 
conditions it should be mentioned that the proof of the invertibility 
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of C^(k,t) for sensor failures la general, thus it is also valid for 
tine- invariant systems. 

3.5.1 Detectability of State-Step Failure in Time-Invariant Systems 

It was shown in Chapter 2, Section 2.4, that for the time-invariant 
system C^(k,t) matrix becomes a function of d • k - t where k is 
the number of observations and t is the failure time. Consider the 
general formulation of C^(d) for time-invariant systems 


^(d) - £ cJ'ajv'^O) 

J-0 


(3-50) 


where V is the covariance matrix of the residuals and G^(j) for 
i - 1,2,3 is given in Table 2.2. Equation (3-50) can also be written 
in the following form 


C t (d) 


c!(0) ic|(l)l . . .1 G*(d) 
1 I 1 I I 1 


V 1 


G t (0) 

v' 1 0 

• 


C^l) 

• 

0 


• 

< 

1 

t tt 


i 

n 

h- 

s — \ 

Q. 

1 


( 3 - 51 ) 


or 


c t (d) - yjny i 


(3-52) 


The matrix \l is composed of V 1 matrices as diagonal blocks. Since 
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V ' Is positive definite then for C^(d) to be Invertible, the matrix 

Y must be also positive definite. Before proceeding to establish the 
conditions for invertibili ty of (d) , it should be stated that equa- 
tion (3-52) Is valid for all failure modes In time-invariant systems be 
cause no restriction was Imposed on i t the type of the failure. 

For state-step failure the y^(d) matrix is given by 


Y 1 (d) 


l I 

H I H + H* I 

1 • 



(3-53) 


Equation (3-53) is derived by substituting equation (2-56). For G^(j) 
for j » 0,1.,,,. d. Equation (3-53; can be written as 


Y 1 (d) 


H 


m 




t rett) 0-54) 


The lower block triangular matrix on the right-hand side of equation 
(3-54) is of full rank. Thus if 3(d) matrix is of full rank then 
Y^(d) will be positive definite and C^(d) will be invertible. The 
3 (d) matrix is identical to the matrix used to test the observability of 
a system. Thus a detectability test resulting from the above discussion 
can be stated as: a state-step failure is detectable if 3(d) is of full 

rank. Furthermore if 3(d) is not invertible in n - 1 steps, where n 
is the dimension of the system, it will never be invertible. This fol- 
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lows from a property of linear constant systems that if an n dimen- 
sional linear constant system is not completely observable in n - 1 
steps it will never be completely observable. 

As a result of this finite-step detectability property a guideline 
may be established for selecting the observation window size that was 
introduced in Section 2.3.3. In that section the range of the failure 

A A 

time was restricted to k-M<t^k-N where t is the estimate of 
the failure time and N and M are window limits. The window of ob- 
servation can be written as N < k * t £ H, which is suitable for es- 
tablishing the limits on d • k - t. Since the invertibility of C } (d) 
will not be effected by d > n - 1 then N may be selected to be 
N <_ n - 1. In summation the invertibility of C^(d) for state-step fail- 
ures is related to the observability of the system under study. Hence, 
if the n dimensional system is not completely observable in n - 1 
steps then the state-step failure in that system is not detectable 
either. The derivation of these conditions forms a basis for establish- 
ing the detectability criterion for state-jump failure in the next 
section. 

3.5.2 Detectability of State-Jump Failure in Time-Invariant Systems 

The general form of the C^(d) matrix in equation (3-52) is also 
valid for state- jump failure. In this case, however, the matrix Y. ; (d) 


is given by 
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Y (d) 


ORlGffJAJ. PtV-r 
°f poof? Q:.»At rr'y 



(3-55) 


The block diagonal matrix on the right-hand side of equation (3-55) is 
of full rank and the second matrix is identical to the one derived for 
state-step failure in equation (3-54). Thus the conclusions of the pre- 
vious section are also applicable to state— Jump failure case as well. 

It follows from the discussions in Sections 3.3 through 3.5 that 
the C t (d) matrix (see Table 2-2) has an important effect on the suc- 
cessful detection of a failure. The effect of the (d) matrix can be 
summarized as follows. Fii st, to calculate the GLR index, equation 

(3-48), it is necessary that (^(d) be invertible. The second effect 

2 

of C^(d) is that the noncentrality parameter, 6 , of correct detec- 
tion is a function of C^(d) (see eq. (3-24)). Since the larger 6^ 
is the higher the probability of correct detection will be then C i (d) 
has a direct influence over the probability of correct detection. Fi- 
nally it can be shown that (^(d) is the covariance matrix of the fail- 

A 

ure vector estimate, v (proof is presented in Appendix D). Hence, the 
accuracy of the failure vector estimate depends on C^(d). Therefore, 
it is important to study the behavior of (d) as the number of obser- 
vations increases. For this purpose the next section is dedicated to 
the discussion of the asymptotic behavior of the C^d) matrix. 
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3.6 Asymptotic Behavior of C-Matrix in Time-Invariant Systems 

In this section the behavior of C^(k,t) (defined in eq. (2-35)) for 
time- invariant systems as the number of observations, k, increases will 
be studied. It was shown in Section 2.4 that for time- invariant systems 
the matrix C^(k,t) becomes a function of d ■ k - t, i.e., C^(d). Since 
t, the failure time, is constant, then the study of the behavior of 
C i (d) as a function of d is equivalent to studying the behavior of 
C t (d) as a function of k. The behavior of C^d) for each of the three 
modes will be considered separately. 

1. State-Step Failure 

Consider the general form of the C^d) for time-invariant systems 
d 

C,(d) “ Yj G i ( j )V ~ lG(J) °” 56) 

j"0 

Since V, the covariance matrix of the residuals, is constant then the 
asymptotic behavior of C^(d) depends on G^(j). For a state-step fail- 
ure 

j 

Ci<j) = H £ + J ' S 0-57) 

3 = 0 

Equation (3-57) was initially derived in equation (2-56). Expanding the 
matrix series in equation (3-57) results in 

G l(j) = + ^" 1 + cf)- 5 " 2 + . . . + il (3-58) 


or 


SI 


G x (j) - M 


I 

K«*0 
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post multiplication of equation (3-59) by <{> yields 

j 

G 1 (J)4> - H ^ * 8+1 
s-0 


(3-59) 


(3-60) 


Subtracting equation (3-60) from equation (3-59) and rearranging terms 
results in 

G 1 (j ) = H (I - <}> j+1 )(I - -J))" 1 (3-61) 

The C^(d) matrix can then be written as 


C x (d) 


d 

D 


H (I - 4> J+1 )(I - 40 


j=0 


f V-[h 


(I - 4> J+1 )(I - 40 


■] 


(3-62) 


Rearranging the terms inside the summation yields 


C x (d) - (I - ♦) 


-T 


£ (l - (hV 1 H)(I - «J +1 ) 

U-0 


(i - 40 


-l 


(3-63) 


Since only the terms inside the brackets are functions of d, the behav- 
ior of these terms will effect C^(d). Thus consider 



(3-64) 


where 


is defined as 
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V - H V H 

Equation (3-64) can be written 
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(3-65) 


(3-66) 


The last two terms in equation (3-66) can be written in closed form by 
following the same procedure used to derive equation (3-61); thus equa- 
tion (3-66) can be rewritten as 


B (d) = (1 + d)V 2 + 






X 4> 1 V - V<J>(I - 4> d+1 )(I - 4>) 1 (3-67) 

Now as d -> 00 then approaches zero because the system under study 

is assumed to be stable, hence, all the eigenvalues of <f> are within 
the unit circle. Hence, the limit of B(d) as d -*• * can be written as 


lim B(d) 

d -> 00 


lim 

d -x «> 


(1 + d)V + lim 

1 d •+ «* 



V 


j+1 


- (I - <J>)” T <j> 1 V - v*(I - <f) -1 (3-68) 

It can be seen from equation (3-68) that as d -> 05 the elements of B(d) 
and thus the elements of C (d) will grow larger. Thus at least some 
eigenvalues of C^(d) will grow as the number of observations increases. 
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The increase in the eigenvalues of C^(d) improves the probability of 
correct detection of state-step failures that lie in the direction of 
the corresponding eigenvectors. This can be se°.n easily by examining 
the noncentrality parameter for 

6^ - \> T c^(d)\> (3-69) 

2 

As 6 Increases in value the probability of correct detection im- 
proves. Hence, the failure vectors which lie in the direction of eigen- 
vectors corresponding to growing eigenvalues have a higher probability 
of being detected as k increases. 

2. State- Jump Failure 

As in the case of state-step failure, the behavior of C^(d) matrix 
depends on the behavior of C^Q) matrix. The G^J) matrix for a 
state-step failure is given by 

G 2 (J) « H$ J (3-70) 

Taking the norm of equation (3-70) yields 

||g 2 (JMI - l|H* J || (3-71) 

It can be shown that (see Appendix B) 

1 |g 2 (J) ! I < ||H|| 1 U J | I (3-72) 

Now since the system under study is assumed to be stable the eigenval- 
ues o£ <J) are within the unit circle. Hence, as j -*• 00 the matrix 
4>^ becomes a null matrix, thus j | -* 0 as j -*• <*>. It follows 
that 

! I G (j ) } | * 0 

j-w» 


(3-73) 
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The above results will be used to show that the sequence |C 2 (1 ) « 
C^(2), . . C 2 (<i)^ forms a Cauchy sequence, thus it converges to a 
constant matrix as d + To accomplish this consider the following 
definition 


q 

AC(d,q) A ^ G^(j)v" 1 G 2 (j) - C^q) - C 2 (d) (3-74) 

j-d+1 

where q > d. To establish that the sequence jc 2 (l), C^(2) 

C 2 (d)j forms a convergent Cauchy sequence, it should be proved that the 
norm of AC(d,q) approaches zero as q -> 00 . Now to prove this consider 
G 2 (j) for state-jump failure in equation (3-70) and Ac(d,q) in equa- 
tion (3-74). Substituting for c 2 (j) in equation (3-74) from equation 
(3-70) yields 

q 

AC(d,q) - ^ HVW (3-75) 

j-d+1 

Taking the norm of both sides and using the properties of the matrix 
norm yields 

q 

| | AC (d, q) | | < hVWH 


j-d+1 

q 



j-d+1 


< 
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or 


||4C(d,q)|| < (q - d - 1)||V" 1 || | |«| | 2 | |* 2<i | | (3-76) 

O J 

Now as d •+■ 00 the term ||(}) [| approaches zero, thus the left-hand 

side of the Inequality In equation (3-76) vanishes as d -*■ ®. There- 
fore ||AC(d,q)|| -► 0 as d -► 00 which proves that the sequence 
jc 2 (l), C 2 (2) , .... C 2 ^)j formfl a convergent Cauchy sequence. This 
result indicates that 6 (aq. (3-69)) for state-jump failure approaches 
a constant limit as d -*• °». Hence, the probability of correct detection 
for state- jump failure does not change after d becomes sufficiently 
large. This also has the implication that the estimate of the failure 
vector will not significantly improve after C 2 (d) has reached its limit. 
As Chow (Ref. 3) suggests the rate of convergence of C(d) to its limit 
may be used in establishing the length of window N < d £ M for detec- 
tion. That is, the value of M can be selected based on how fast the 
corresponding C^(d) approaches its limit. Next the asymptotic behavior 
of C^(d) matrix for sensor-step failures will be developed. 

3. Sensor-Step Failure 

In order to study the asymptotic behavior of the C^(d) matrix for 
sensor-step failures consider the formulation of C^(d) for this type of 
failure (initially derived in eq. (2-79)): 

C 3 (d) - (d + 1)V _1 (3-77) 

It can easily be seen from equation (3-77) that as d -► °°, the elements 
of C^(d) will grow. Therefore, at least some of the eigenvalues of 
C^(d) will increase as d ■+■ 00 . This has the implication that for actual 
failures in the direction of eigenvectors corresponding to growing 
eigenvalues the probability of correct detection improves as d -+• °°. 
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d -*■ This can be easily verified by computing C^(d) 1 1 om equation 
(3-77) as 

c >> - 7T7 v (>78) 

Another important conclusion which follows from equation (3-78) is that 
if the variances of the residuals are large then more observations are 
needed to improve the estimate of the failure vector, v. 

3.7 Summary and Discussion 

The results developed in this chapter can be summarized under three 
main topics. These topics are the probability distribution of the JLR 
index, failure detectability, and the asymptotic behavior of the C^d) 
matrix. The probability distribution of the GLR index was determined 
to be a noncentral chi-squared when a failure actually occurs. On the 
other hand when no failure has occurred the probability distribution of 
the GLR index is a central chi-squared distribution. It was established 
that when the direction and magnitude of the failure vector is restric- 
ted to a known vector, v , the simplified GLR index will be distributed 

o 

as a Gaussian random variable. Identifying the distribution of the GLR 
index leads to the calculation of four important detection probabilities. 
These detection probabilities are probability of correct detection, 
false alarm, cross detection, and wrong-time detection. Calculation of 
these probabilities furnishes a guideline for selection of a threshold 
for GLR decision rule. For instance by utilizing the probability of 
false alarm a threshold can be selecteJ such that a low number of false 
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alarms would result. 



Another major utility of the detection probabilities is that they 
offer a way of evaluating the performance of the CLR detector. In this 
regard* the probability of correct detection provides a measure of con- 
fidence in the overall result of detection and isolation while false 
alarm probability gives an indication of the consistency of the detec- 
tor. The probability of cross detection can be used to evaluate the 
isolation capability of the detector and the probability of wrong-time 
detection offers a way of measuring the accuracy of the failure time 
estimate. 

After identifying various probabilities associated with the GLR 
technique, it '* essential to determine what failures can be detected. 

It was established that the detectability of a failure is dependent on 
the invertability of the C^k.t) matrix. Based on this result It was 
shown that sensor-step failures are always detectable. For the time- 
invariant systems detectability of actuator failures is related to sys- 
tem observability and failures which fall into the unobservable sub- 
space are not detectable. In addition it was shown that if C^Cd) for 
actuator failures is not invertible in n - 1 steps then It will never 
be invertible. 

Failure detectability can also be examined by comparing the 

probabilities of correct detection and false alarm. It was shown in 

2 

Section 3.3 that the noncentrality parameter, 5 , for false alarm is 
zero. However, the noncentrality parameter for correct detection is 
nonzero and is given by 

6 2 - v^Ck.Ov (3-79) 

Now if C^(k,t) has an eigenvalue which is very close to zero then any 
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failure along the eigenvector corresponding to the small eigenvalue 
2 

drives <5 close to zero. Thus the probability of correct detection 
becomes very close to the probability of false alarm. This confirms the 
previous result that if the C^(k,t) is not invertible (i.e., (^(k.t) 
has at least one zero eigenvalue) then not all failures are detectable. 
From a similar argument it can be concluded that the probability of cor- 
rect detection of failure vectors lying in the direction of eigenvectors 
corresponding to large eigenvalues is higher. It follows from the above 
discussion that (d) plays an important role in successful detection 
of a failure. Since C^(d) is a function of the number of residuals ob- 
served then it is important to study its behavior as more observations 
are taken. 

The significance of studying the asymptotic behavior of C^(d) ma- 
trix is twofold. First, the invertibility of C^Cd) determines the de- 
tectability of failures. The second reason for such study is that the 
C^^(d) is the covariance matrix of the estimate of the failure vector, 
hence it is a measure of the estimate accuracy. The results of studying 
the asymptotic behavior of C^(d) for the three modes of failure are as 
follows. For state-step and sensor-step failures C^Cd) will have some 
eigenvalues which grow as d -* °°. On the other hand C’ (d) for state- 
jump failures converges to a constant matrix. Thus the corresponding 
GLR index, L^(k,t), will also approach a constant value. 

The elements of C^Cd) for sensor-step f ailui e (eq. (3-77)) gro',' 
as d hence both the failure detection probability and the accur- 

acy of the failure vector estimate improve as d -*■ <*. If C^(d) in 
this case is a diagonal matrix then C^(d) is also a diagonal matrix 
which implies that the elements of the failure vector estimate are 
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mutually independent. This is & desirable feature of the proposed de- 
tection technique because the estimate of each sensor failure is not af- 
fected by a failure in another sensor. This facilitates the isolation of 
failed sensors as they are associated with the elements of the failure 
vector which are significantly different from zero. 

The study of the statistical properties of the proposed GLR tech- 
nique provides substantial information regarding the reliability of the 
detection and Isolation. Furthermore, a simple condition for detecta- 
bility of failures can be established and finally the study of asymptotic 
behavior of C^(d) furnishes a guideline for the necessary number of ob- 
servations. In the next Chapter the application of the proposed detec- 
tion technique to a jet engine will be presented. 
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PERFORMANCE EVALUATION OF CLR TECHNIQUE 

In this chapter the application of the proposed GLR detection tech- 
nique to sensor/actuator failures in a turbofan jet engine will be pre- 
sented. The objective is to evaluate the performance of the technique when i t 
is applied to a realistic problem. The study provides more insight into the 
problems and capabilities associated with the on-line implementat ion of the 
technique. This study is performed by simulating the sensor/actuator fail- 
ures of a jet engine in a nonlinear digital simulation of the engine. Then 
the effect of sensor/actuator failures on the output measurements is 
used in the GLR detection routine to detect and isolate the failures. 

The description of this study and the associated results are pre- 
sented in the following order. In Section 4.1 a brief description of 
the engine and the nonlinear simulation is given. In Section 4.2 the 
digital simulation of the sensor/actuator failures is described. Then in 
Section 4.1 the performance of the GLR technique is tested by utilizing 
the digital simulation program. The results ol Section 4. 3 are based on 
using the full-scale nonlinear engine simulation as the engine model 
(Fig. 3.2) for generating model residuals. To evaluate the effect of 
model accuracy, in Section 4.4 the nonlinear simulation is replaced with., 
linear engine model derived from the nonlinear simulation. Finally in 
Section 4.5a summary and discussion of the chapter is presented. 

4.1 Turbofan Jet Engine 

A turbofan jet engine developed by General Electric Company under 
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contract to the National Aeronautics and Space Administration waa sel- 
ected for the application of the proposed GLR technique. The engine is 
referred to as Quiet Clean Short-Haul Experimental Engine, QCSEE. Two 
models of QCSEE for Over The Wing (OTW) and Under The Wing (UTW) utiliza- 
tion were developed. For the purpose of this study the UTW model was 
used. A schematic diagram of the UTW model is given in Figure 4.1. 

The fundamental objective of the QCSEE development has been to de- 
velop an advanced engine for short-haul commercial aircraft having 
Short- Takeof f-Or-Landing (STOL) capability and producing less noise and 
atmospheric pollution than current aircraft. Another specific technical 
objective of the QCSEE program was to develop a digital control system 
for the engine to be evaluated in a simulated flight environment. To 
achieve these objectives, a turbofan Jet with special design features 
evolved. Some of these design features are: a composite high Mach in- 

let ; a variable-pitch fan with composite blades ; a variable geometry ex- 
haust nozzle; an advanced core and low pressure turbine; and a treated 
fan duct with an acoustic splitter. Also a digital control system was 
designed and incorporated in the engine to perform the overall eng'ne 
computation and evaluate the engine command. The digital control moni- 
tors the engine sensors and generates signals for manipulating fuel 
flow, fan pitch angle, and fan nozzle area. Fault indication and cor- 
rective action is also incorporated in the digital control system. 

As it was discussed in Chapter 1, the detection techniques using 
analytical redundancy are mainly suitable for engines with digital 
control systems. Since QCSEE provides a digital control system it is an 
appropriate choice for the performance evaluation of the proposed detec- 
. .on technique. In addition the sensors and actuators of QCSEE are de- 
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signed to be compatible with the digital control, therefore the corre- 
sponding failure study will be realistic and applicable. 

QCSEK has tour input controls which can be used to control the en- 
gine response. These input controls are fuel flow, fan nozzle area, 
fan pitch angle, and compressor stator position. The compressor stator 
position is controlled indirectly by the hydromechanical control backup 
system; hence, it is not used for this study. The fuel flow to the oom- 
busLor is controlled by an electrohydraul ic servovalve. The fan nozzle 
actuator adjusts the position of four interlocking flaps of the nozzle 
as a function of flow and pressure from an electrohydraulic servovalve. 
For the variable-pitch fan the actuator Is a ball-spline system. The 
mechanical rotation for this system is provided by a hydromechanical 
motor. The digital control corrects the position of the blades by send- 
ing a signal to the servovalve controlling the flu: u flow to the hydro- 
mechanical motor. 

F.ngine sensors are designed to be compatible with the digital con- 
trol system. Pressure, temperature, and speed sensors are utilized in 
QCSEE. Three types of temperature sensors are utilized. A thermo- 
couple is used to measure the compressor discharge temperature and a 
platinum wire-wound resistance-type device is used to monitor the fan 
inlet temperature. To measure the core engine Inlet temperature a zir- 
conium gas-filled coil Is used. Application of different temperature 
sensors Is based on the range, response time, accuracy, and sensitivity 
of the sensor. For measuring fan speed a magnetic pi c.kup system is used 
while for compressor speed voltage from al ternator windings is employed. 
All absolute and relative pressures in the engine are monitored by 
thin-film strain gauge bridge transducers. More detailed information re- 
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garding QCSEE sensors and actuators is available in reference 48. 

4.1.1 QCSEE Simula ti : 

fn order to evulufe the performance of QCSEE, NASA Initiated a 
program for studying QCSEE performance in a STOL flight environment. A 
manned flight simulator was used to study engine performance. Details 
of the QCSEE simulation program and some results of the flight simula- 
tion program are given in reference 49. A main requirement of this 
program was a reasonably detailed engine simulation which would provide 
realistic engine response with acceptable execution time. For this 
simulation study a digital QCSEE simulation was selected. The execu- 
tion time for QCSEE simulation must be such that the overall flight 
simulation could be accomplished in real time. To meet the time re- 
quirement, the high frequency elements of the engine were not included 
in the development of the simulation for the engine. 

The simulation was derived from trie real QCSEE propulsion system. 
This simulation represents the engine and control system dynamics. 

Since the high frequency elements were excluded, only rotor dynamics 
and compressor and turbine capacitances are included. To represent 
accurately the operation of the high Mach inlet engine ail major engine 
components for the bypass duct and core are included in the model. In- 
let throat and duct performance are also included in the model. Simi- 
larly, the fan and compressor are modeled using pressure and tempera- 
ture ratio maps. The combustor was modeled by relations which include 
pressure drop and heat rise. Combustor dynamics were not included. 

The engine turbines were represented by flow and enthalpy drop maps as 
functions of pressure ratio and corrected speed. 

The simulation of QCSEE engine control consisted of two parts. 
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digital and hydromechanical controls. In the digital part the fan speed, 
inlet Mach number, and engine pressure ratio controls were modeled. 

The hydromechanical segment represented core speed, acceleration, and 
deceleration controls. 

The simulation had four engine states, four iterative loops, four 
control sensor states, and four actuator states. For programming the 
model, a computationally efficient curve fitting technique was used to 
represent various multivariable functions. Model dynamic equations 
were solved using a modified Euler integration technique. The result- 
ing digital engine simulation program is accurate, stable, and runs 
faster than real time. 

The QCSEE digital simulation model was selected to be used in 
evaluation of the performance of the proposed GLR failure detection tech- 
nique. Specifically, two duplicates of the simulation program were em- 
ployed to represent the actual engine and the engine model (see Fig. 
4.3). Then sensor/actuator failures were introduced in the program 
representing the engine and the resulting residuals were tested for 
failure. Although the proposed GLR technique is developed for linear 
systems, using nonlinear models of the engine provides a more realistic 
measure of the GLR performance. Following this evaluation, the nonlin- 
ear simulation program representing the model of the engine was re- 
placed with a linear model of the engine. These simulation studies 
provide a measure of the effects of model inaccuracies on failure de- 
tection. The proposed GLR technique, however, requires a linear state 
space representation of QCSEE. The derivation o F the state space ma- 
trices for QCSEE is discussed in the next section. 
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4.1.2 QCSEE Linear Model 

For evaluating the performance of the G1.R technique a linear state 
space model representation of QCSEE at the 62.5% engine power level wus 
generated. The linear model was generated from the QCSEE digital sim- 
ulation and is briefly described in this section. 

Consider the schematic diagram of the QCSEE engine in Figure 4.2. 

In order to develop a linear model it ia necessary to select the engine 
states. The following engine variables were selected as engine states: 
P12 - Fan inlet duct total pressure 
P13 - Fan discharge total pressure 
P4 - Compressor discharge pressure 
P8 - Core nozzle total pressure 
NL - Fan speed 
NH - Compressor speed 
T3 - Compressor discharge temperature 
T4 - Combustor discharge temperature 
Three inputs are given as follows: 

XMV - Fuel -.uctering valve setting 
X18 - Fan nozzle area actuator position 
THETAI - Fan pitch mechanism drive motor position 
The set of output variables includes different types oi measurements: 

I'M I - Engine Intel static pressure 

I’ 13 - Fan discharge total pressure 

P4 - Combustor pressure 

1’8 - Core nozzle total pressure 

NL - Fan rotor speed 

NH - Compressor speed 
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T41C - Calculated turbine temperature 

FN - Net thrust 

Based on the above selection of state variables and the given input- 
output variables, a linear model of the engine ualng a small signal 
perturbation technique is developed (Ref. 47). The corresponding A, 

B, C, and D matrices for the linear model representing a 62.5% power 
level condition are presented in Appendix E. The dynamics of the en- 
gine control are not included in the linear model because only the de- 
tection of engine sensor or actuator failure is of interest. 

To develop the GLK detectors for QCSEE it is necessary to discre- 
tize the system matrix, A, of the linear model. This is accomplished 
by using standard discretization techniques (see, e.g.. Ref. 53). The 
computation of the discrete system matrix, <j> , completes the essential 
information for the development of the GLR detection program. Utilizing 
the detection program, the performance of the GLR technique will be 
evaluated by failure simulations. The failure simulations will be dis- 
cussed in the next section. 

4.2 GLR Simulation Program 

In this section a description of the digital simulation program for 
evaluating the performance of the GLR detection technique is presented. 
In the first part two duplicates of the nonlinear QCSEE simulation pro- 
gram are used to represent the engine and the model of the engine as 
shown in Figure 4.3. The objective in this part is to evaluate the 
performance of the detection technique when the model follows the engine 
perfectly. Sensor/actuator failures in this case ere simulated in the 
program representing the engine. In the second part the nonlinear 
QCSEE simulation program representing the engine model is replaced with 
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the linear model described in Section 4.1.2. This will result in a dis- 
crepancy between the engine output and the linear model as the model 
does not follow the engine perfectly. Thus this sLudy will provide in- 
sights into the effect of the degree of model accuracy on the behavior 
of the GLR detectors. The configuration for this simulation is illus- 
trated in Figure 4.4. 

4.2.1 Failure Simulation Under Perfect Modeling 

Consider the GLR simulation arrangement in Figure 4.3. Three main 
elements of this configuration are the two nonlinear QCSEE digital sim- 
ulations and the GLR detection program. The nonlinear QCSEE simulations 
represent the engine and the engine model. The inputs to both the en- 
gine and engine model are the same. These inputs are: fuel metering 

valve position, XMV; fan nozzle actuator position, X18; and fan pitch 
mechanism. As it is shown in Figure 4.3, the outputs of the engine 
model are subtracted from those of the engine to compute the model re- 
sidual. The six output selected for residual calculations are: 

PS11 - Engine inlet static pressure 

NL - Fan rotor speed 

NH - Compressor speed 

P12 - Fan inlet duct total pressure 

P4 - Combustor pressure 

P8 - Core nozzle pressure 

The residuals computed from the above outputs are transmitted to the 
GLR detection program for sensor/actuator failure detection. 

Using identical QCSEE digital simulations for the engine and engine 
model representations allows studying the performance of GLR in the pre- 
sence of perfect modeling. In this case when no failure has occurred 
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the difference between the engine output and the model output is the 
engine sensor noise. The QCSEE simulation program does not incorporate 
the engine sensor noise. Therefore to generate realistic engine out- 
puts, the sensor noise characteristics must be added to the outputs of 
the QCSEE program representing the engine. 

4.2.2 QCSEE Sensor Noise Characteristics 

Due to tne unavailability of QCSEE sensor noise characteristics the 
noise characteristics of an F-100 engine were used. This is justified 
on the basis that comparable sensors are used for pressure, speed, and 
temperature measurements in the QCSEE and the F-100 engines. Thus ac- 
tual sensor measurements from an F-100 jet engine altitude test (Ref. 

22) were utilized to compute the sensor noise characteristics. For this 
purpose, 100 samples of engine pressure, temperature, and speed mea- 
surements were used to calculate the variance for the three types of 
sensors. This process was repeated for two engine operating points and 
the resulting variances were averaged over the two points. The sensor 
variances computed in this fashion are the elements of the diagonal sen- 
sor noise covariance matrix which is shown in Appendix F. 

Using the computed noise covariance matrix, zero mean independent 
Gaussian variables were generated and were added to the output of the 
QCSEE simulation representing the engine. Addition of the noise to the 
engine output, completes the measures necessary for computing the re- 
siduals required by the GLR detection program. 

4.2.3 GLR Detection Program 

The GUR detection program is designed to detect failures in time- 
invariant systems. The program is not restricted to QCSEE applica- 
tions and can be utilized for any time -invariant system. 




The inputs to the GLR detection program are: the discrete system 

matrix <f> ; the output mitrix H; the model residual vector sequence 
r(k); residual variance V; the input and output dimensions of the sys- 
ter ; the failure threshold e; the first detection test observation 
number; the failure time sliding window limits M and N; and the max- 
imum number of residuals. In addition the number of observation at 
which the first detection test is to be performed should also be speci- 
fied in the program. The logical structure of the GLR program is di- 
vided into three parts. In the first part the matrices G^(d) and 
C^Cd) (see Table 3.2) for the three failure types are computed and 
stored. Since these matrices remain unchanged they may be computed and 
stored off line and then retrieved for GLR computations. In the second 
part the GLR indices, L^k.t), (Table 3.2) for the three failure types, 
i, and for all possible values of failure time, t, inside the interval 
k-M< i < k- N are calculated. Then, for each type of failure, 
L^(k,t) is maximized over the values of t. These maximum values of 
the GLR indices are compared with each other and the largest value is 
selected. This two-step maximization for the failure type, i, (i - 
1,2,3) and the failure time, t, (k - M £ t £ k - N) can be expressed as 

L-(k,t) =*|Max Max L (k,t)l (4*1) 

i L ^ t 1 J 

If the maximum GLR index computed in this fashion exceeds the threshold 

A A 

£ then the program declares a failure of type i at time t. The 
threshold e is chosen such that the probability of false alarm will 
be less than 0.001. Since the false alarm probability is distributed 
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as a central chi-squares, then c can be selected directly from the 
chi-squared distribution tables (e.g., see Ref. s6). For the QCSEF. 
simulation there are six output residuals, therefore there will be six 
degrees of freedom associated with the GLR index. The threshold was 
selected approximately twice the average of the maximum GLR index under 
a no-failure condition, or e ■ 34. For six degrees of freedom this 
results in a false alarm probability of less than 0.001 for each oi the 
three GLR detectors. 

Finally, in the last part of the program the estimate of the fail- 
ure vector, v, is computed and sensor failure isolation is accomplished. 
The calculation of the estimate of the failure vector is achieved by 
employing the maximum likelihood estimator for v in equation (3-52). 
Sensor failure isolation calculation logic is derived from the con- 
strained GLR (CGLR) technique which was described in Section 3.3.3. 
Specifically, a set of vectors are associated with possible sensor 
failures. Each vector in this set has all zero elements except unity 
at the position corresponding to the failed sensor. In the QCSEE sim- 
ulation, for single failure isolation the vector set contains six vec- 
tors of dimension 6. As an example the failure vector associated with 
the fourth sensor has the form of: 



Application of CGLR leans to selection of the vector associated with the 
failed sensor and thus isolates the failed sensor. The detection deci- 
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sion rule lor CGLR in derived an follows. The CGLR Indices for sensor- 
step failure are computed from equation (3-37) and maximized with respect 
to failure time, t, and constrained vector directions, f ^ . The maximum 
value of CGLR selected in this fashion is compared with threshold e for 
failure detection. This comparison can be used as a cross ch^ck for the 
detection results of GLR. At the same time, the failure vector direc- 
tion associated with the maximum value of the CGLR is utilized to iso- 
late the failed sensor. The failure time, t, associated with the maxi- 
mum value of CGLR can also be used as a cross check for the estimate of 
failure time, t, which is computed in the second part ol the program. 

A flow diagram of the complete program logic is given in Figure 4.5. 

4. 3 GLR Performance Tests 

To evaluate the performance of the proposed GLR technique for the 
case of perfect modeling three categories of failure simulation tests 
were performed: (1) No failure, (2) Single sensor or actuator failure, 

and (3) Multiple sensor/actuator failure. The no-failure tests eval- 
uate the consistency of the detection technique and establish a base- 
line of performance. 

4. 3. 1 Consistency Test 

The consistency of the GLR technique is tested by applying the GLR 
technique to model residuals when no failure has occurred. For this 
purpose two noise sequences for the six sensors of QCSEE are generated 
by utilizing the same covariance matrix (given in Appendix F) but with 
two different seed numbers. Then two consistency test runs are made 
by employing these noise sequences. For each run, the noise sequence 
is added to the output of the QCSEE program representing the engine 
(Fig. 4.3). Then without inducing any failure in the engine the model 
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residuals are computed. It should bo mentioned that in this case the 
model residuals are identical to the output sensor noise. Since no 
failure has occurred the CI,R indices over the sliding detection window 
must be smaller thun the threshold 0 a 14). Application of the GLR 
technique to the model residuals in this case yields the expected re- 
sults. That is the maximum GLR index, L'(k,t), is substantially smaller 
than the threshold e. These results are shown in Figures 4.6 and 4.7. 
In each of these figures the maximum GLR index, L«(k,t), is plotted ver- 
sus the observation time, k. The limits of the sliding window in this 
case are N = 3 and M - 13 and the total number of observations is 
k - 30. The length of sampling interval for this test and all the sub- 
sequent tests is 0.08 second. Figures 4.6 and 4.7 are useful in provid- 
ing more insight into the relationship between the probability of false 
alarm and the selected value of the threshold, c . For example consider 
Figure 4.6, it can be seen from this figure that for c < 18 there will 
be at least one false alarm. The probability of false alarm for e = 18.0 
is approximately 0.0065 which is 6.5 times larger than the probability 
of false alarm when c. = 34. Finally, the plots of the GLR indices in 
Figures 4.6 and 4.7 indicate that the GLR results are highly consistent. 
Next the capability of the GLR technique in detecting single sensor 
failures will be examined in the following section. 

4.3.2 Single Sensor Failure Tests (Using Sensor Set A) 

In this category of tests performance of the GLR (under a perfect 
modeling assumption) in detecting a single sensor/actuator failure is 
studied. For the single sensor failure study a step failure is intro- 
duced in each sensor separately. The magnitude of the failure for all 
sensor failure simulations was selected to be larger than the tolerable 



sensor inaccuracies (normally three standard deviations of the senBor 
noise). Specifically, the failure size van selected to be equal to five 
standard deviations of the noise. Then, the failure sizes in pressure, 
speed, and temperature sensors are, respectively, 0.5%, 0.19%, and 0.55% 
of the nominal value of the corresponding sensor measurements. The nor- 
malize^ covariance matrix for sensor noise and the nominal values are 
given in Appendix F. 

Two distinct groups of single sensor failure tests are performed. 

For this purpose two sets of sensors are utilized, namely set A and 
set B. Each set contains six sensors. Specifically, the sensors in 
set A are the same ~>s in Section 4.2.1. The sensors in set B are the 
same as in set A except P8 is replaced with T3. The results of single 
sensor failure tests using set A are given ».n Table 4.1. The actual 
failure time for the results in Table 4.1 is at the fifth (5) observa- 
tion and the window limits for failure time are M ■ 23 and N ■ 3 . 

The total number of observations in these runs is 30 and the first de- 
tection test is performed at the tenth (10) observation. The time of the 
first detection test was selected somewhat arbitrarily. The result ; in 
table 4.1 indicate that all of the sensor failures are properly detected 
and the failure times are correctly estimated. Ailso the isolation of 
the failed sensors in all six runs is successfully achieved. The esti- 
mate of the failure time computed from the CGLR section of the program 
is in agreement with the estimate from the GLR detection calculation. 

The estimate of failure size for two typical output sensors , namely 
PS11 an^ NL, are plotted in Figures 4.8 and 4.9. These plots indicate 
that the estimate of failure size in both pressure and speed sensors are 
very close to the actual value of the failure size. It is shown in 
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TABLE 4.1 

SIMULATION RESULTS FOR SINGLE SENSOR FAILURE 
(Using Sensor Set A) 

Sensors PS11 NL NH P12 P4 P8 

Detection 

Detected 3 3 3 3 3 3 

type 

Detected 3 35333 

failure 

time 

Actual 5 55555 

failure 

time 

Isolation C C C C. C C 

Failure 5 55555 

time from 
1 solution 
calculation 

Simulation Number of outputs * 6 

inputs Initial detection test observation ■ 10 

Total observations = 30 
M - 23, N - 3 
r =* 34 

* 

(.' is used to indicate correct isolation. 
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Appendix G that the accuracy of the failure size estimate Improves as 
the number of observations increases. Examining the plots in Figures 
A. 8 and 4.9 reveals that as k becomes larger the estimates of fail- 
ure size tend toward the actual values of failure sizes. The rerc,; In Lng 
difference between the e3ti r «ates and the actual failure size is due to 
sensor noise characteristics. That is, if the mean of the noise se- 
quence is not truely zero, then the estimate of failure size will not 
converge to the exact value of the failure size. This is shown to be 
true for all failure types in general in Appendix G. 

4.3.3 Single Actuator Failure Tests (.Using Sensor Set A) 

In this section single actuator failure tests are discussed. The 
output sensor measurements utilized for these tests are the same as be- 
fore, namely, Poll, NL, NH, P12, P4, and P8. Likewise the threshold 
and the limits of the sliding window are unchanged. The failure size 
for actuator step failures is set to 5% of the nominal value of the ac- 
tuator input at 62.5% power level (these nominal values are given in 
Appendix F). For jump failures, the failure size is selected to be 
equal to 20% of Lhe nominal input values. The jump and step failures 
in the fan nozzle actuators are induced in the negative direction be- 
cause the fan nozzle area at 62.5% power level is fully open (i.e., the 
nominal value for X18 is the same as the maximum value of X18) . 

The results of the single actuator failure runs are presented in 
Table 4.2. Each column of this table represents a simulation run. The 
results in this table indicate that the GLR technique has detected the 
failure type properly. Multiple estimates of the failure time for step 
failure in X18 and THETAI resulted. The evolution of these failure 
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TABLE 4.2 

simulation results FOR SINGLE ACTUATOR FAILURE 
(Using Sensor Set A) 

Step failure Jump failure 

Actuators XMV X18 THETA! XMV X18 THETA I 

Detection 

Detected 11 1 22 2 

type 

Actual 3 5 5 5 5 5 

failure 

time 

Detected 55 4 55 5 

failure 6 5 

t ime 7 6 

Number of outputs = 6 

First detection test observation number = 10 
Total observations = 30 
M = 23, N - 3 
e = 34 


Simulation 

inputs 
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time estimates are plotted In Figures 4.10 and 4 11, respectively. 

4.3.4 Single Sensor Failure Testa (Using Sensor Set B) 

The second group of single failure simulation runs are made using 
sensor set B. Specifically, the core nozzle pressure, P8, is replaced 
with the compressor discharge temperature, T3. The reasons for replac- 
ing this output are as follows. The GLR detection technique utilizes 
the effect of sensor/actuator failures on the residuals for detection. 
Since the effect ot actuator failures on various outputs is different 
then the GLR response will be different depending on the outputs used 
to compute the model residuals. Another reason for replacing P8 with 
T3 is that in the first group no temperature sensor was included. Hence 
the new output set contains all three types of sensors, namely, pres- 
sure, temperature, and speed sensors. 

For the simulations using sensor set B the first d ‘tection test is 
performed before the failure occurs. This is in contrast to the simu- 
lation tests using sensor set A in Section 4.3.3. In that section the 
first detection test was performed after the failure occurs. This 
change in the time of the first detection test provides more informa- 
tion about the performance of the technique. One such extra measure of 
performance is to count the number of observations (after the failure 
occurs) required until one of the GLR indices exceeds the threshold, e. 
This is referred to as "time to detection." In situations when no in- 
formation about the type of failure is available (i.e., any of the three 
failure types are possible) another measure of performance can be de- 
fined as "time to correct type." This measure is defined as the total 
number of observations (after the occurrence of the failure) until the 
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GLR program identifies the correct type of failure. To describe the 
concept of these performance measures consider the plots of maximum GLR 
indices for a hypothetical sensor failure in Figure 4.12. The first 
detection test is performed at the fifth (5) observation while the sen- 
sor failure occurs at the tenth (10) observation. However, it can be 
seen that none of the GLR indices exceeds the threshold until the thir- 
teenth (13) observatioi . Thus the time to detection for this example 
is three. It can be seen from the figure that the GLR index correspond- 
ing to state-step failure continues to b? the largest index until the 
sixteenth (16) observation. Then at the sixteenth (16) observation the 
GLR index corresponding to correct failure type (sensor step) becomes 
the largest index. Therefore, the time to correct type is 6. Now as- 
sume that the failure time is still not estimated correctly (as 10) and 
will not be until the eighteenth (18) observations. Hence the total 
detection time is 8. It is noted that these performance measures are 
defined to be compatible with the GLR decision rule which was described 
in Section 4.2.3. It is possible, however, that these measures of per- 
formance be defined differently. For example, the time to detection may 
be defined as the total number of observations before the GLR index cor- 
responding to the actual failure type exceeds the threshold e (rather 
than any of the three indices). 

Simulation results for single sensor failures of this set of out- 
puts are given in Table 4.3. As in the previous case each column in the 
table represents one simulation run. All failures in this group are 
detected properly and the isolation of the failed sensors is also 
achieved successfully. Two measures of GLR response time, namely time 
to detection and time to correct type are also shown in the table. It 
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TABLE 4.3 


SIMULATION 

RESULTS 

FOR SINGLE 

SENSOR 

FAILURE 



(Using 

Sensor 

Set 

B) 



Sensors 

PS11 

NL 

NH 

P12 

P4 

T3 

Detection 







Detected 

type 

3 

3 

3 

3 

3 

3 

Detected 

failure 

time 

10 

10 

10 

10 

10 

10 

Actual 

failure 

time 

10 

10 

10 

10 

10 

10 

* 

Isolation 

C 

C 

C 

C 

C 

C 

Failure 
time from 
isolation 
calculations 

10 

10 

10 

10 

10 

10 

Time to 
detection 

0 

1 

0 

2 

2 

2 

Time to 


9 

4 

2 

3 

4 

correct 







type 







Total 

3 

9 

4 

3 

3 

4 


detection 

time 

Simulation Number of outputs - 6 

inputs First detection test observation - 5 

Total observations ■= 20 
M - 23, N = 3 
t ™ 34 

* 

C indicates correct isolation. 
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follows from these results that all failures are detected in two obser- 
vations or less. However, identifying the correct failure type requires 
more observations. The maximum time to correct detection of the failure 
type for the simulation tests in Table 4.3 is nine observation interval 
periods. Another useful measure of detection speed is total time re- 
quired for correct identification of the failure type and time. In 
Table 4.3 and the subsequent tables this is referred to as: total de- 

tection time. 

The evolution of the estimate of failure size, a, for PL11, NH, 
and T3 sensor failures is shown in Figures 4.13, 4.14, and 4.15, re- 
spectively. The observation number in these plots start with the time 
at which the failed sensor is properly identified. It should be noted, 
however, that the correct estimation of the failure time requires at 
least three observations after the failure occurs. This is due to set- 
ting the upper limit of the failure time window (k - M t k - N) , N, 
to three. This delay can be better understood by examining the maximum 

GLR index, L-(k,t), in equation (4-1). Note that the GLR indices are 
i 

only computed and extremized over the values of t inside the window 
k-M£t£k- N. Now if a failure occurs at the current observation, 
k, the GLR index corresponding to this failure time will not be compu- 
ted until N observations later. Therefore, the correct estimation of 
the failure time would not be possible until N observations later. 

Plots of the maximum GLR index, L„(k,t), corresponding to single 

i 

sensor failure detection in PS11, NH, and T3 are plotted in Figures 
4.16, 4.17, and 4.18, respectively. In these figures the values of 
L?(k,t), from the first detection test at the fifth (5) observation are 

plotted. The time of the actual failure is marked with a vertical 
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dotted line and the value of threshold, ■ ■ 34, is shovm by a horizon- 
tal solid line. The limits ot the failure time window for these plots 
ure M 23 and N ■ 3. 

It follows from the examination of these plots that as soon as 

ff A 

the failure occurs the L. (k,t) starts to increase. This increase 

i 

occurs even before the actual failure time enters the window. The rea- 

if A it * 

son for the rise in L„ (k,t) is that while the calculation of L„ (k,t) 

i i 

is restricted to the observations inside the sliding window, the resid- 
uals used in the calculation include the most recent observation. 

Hence as soon as the residual carrying the effects of a failure is en- 
* 

countered the L-(k,t) will rise. This GLR property is especially de- 
sirable when only the detection of a failure is of interest and the es- 
timate of the failure time is not utilized. 

The effect of the value of threshold on the time to detection can 

* A 

be examined from the plots of L~(k,t). Lower values of threshold, c, 
yield faster detection of a failure in the system but increase the 
required number of observations (after the detection) for identifying 
the correct failure type. This may be easily verified from Figures 
4.16 through 4.18. The increase in false alarm rate due to a low 
value of threshold, e, can be assessed from the same figures. Spe- 
cifically the values of L~ (k,t) before a failure occurs can be com- 
pared with c. Alternatively increasing the value of threshold delays 
the detection but reduces the rate of false alarm and improves the 
identification of correct failure type. Therefore, an alternative 
method of establishing the threshold, e, is to use the time to detec- 
tion as a criteria. Care should be exercised in using this criteria as 


fast detection increases the rate of false alarm, 
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4.3.5 Single Actuator Failure Teats (Using Sensor Set B) 

Corresponding to the set B of output sensors (i.e., PS11, NL, 

NH, P12, P4, and T3) a series of single actuator failure simulation 
runs are made. The results of these runs are summarized in Table 4.4. 
Two modes of failures are simulated in each actuator. The step failure 
size is selected to be 5% of the nominal value of the corresponding in- 
put at 62.5% power level. For the actuator jumps the failure size is 
selected to be 20% of the nominal value of the inputs. For X18 the 
failures are Introduced by subtracting the failure size from the input 
while for the other two actuators the respective failure sizes are added 
to the inputs. The failures are introduced at the thirteenth (13) ob- 
servation and the first failure detection test is made on the tenth (10) 
observation. A total of 30 observations arc tested. The failure time 
window limits at N •» 3 and M ■ 23 and the threshold e is kept at 
34. It is remarked that the value of N assures the invertibil ity of 
C^(d) matrix and the value of M provides a reasonable range for C^(d) 
convergence (see Sections 3.5 and 3.6). 

The results in Table 4.4 indicate that all failures are properly 
identified and the failure time is estimated with good accuracy. The 
estimates of failure time for all jump failures are correctly determined 
while failure time estimates for step failures are accurate to one ob- 
servation. Also the results in Table 4.4 reveal that actuator failures 
are detected immediately following the failures. Identifying correct 
failure type, however, requires more observations after the failure oc- 
curs. The maximum number of observations required for identifying the 
correct failure type is eight observation intervals. Alternatively, 
determination of the correct failure time requires at least three obser- 
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TABLE 4.4 

SIMULATION RESULTS FOR SINGLE ACTUATOR FAILURE 
(Using Sensor Set B) 


Step failure Jump failure 


actuator 

XMV 

X18 

THETAI 

XMV 

X18 

THETAI 

Detection 







Detected 

type 

1 

1 

1 

2 

2 

2 

Actual 

failure 

time 

13 

13 

13 

13 

13 

13 

Detected 

13 

** 

12 

12 

13 

13 

13 

failure 

time 


13 

13 




Time to 
detection 

0 

0 

0 

0 

0 

0 

Time to 
correct 
type 

8 

0 

0 

1 

3 

1 

Total 

detection 

time 

8 

3 

3 

3 

3 

3 

Simulation 

Number 

of outputs = 6 





inputs First detection test observation number = 10 

Total observations * 30 
M - 23, N - 3 
e = 34 


** 


Only at one observation point failure time estimate is 12. 
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vat ions because the upper limit of the failure-time window (k - U <_ t 
k - N) N is three. 

The evolution of the maximum GLR index, L-(k,t) corresponding to 

i 

the step failure in XMV and jump failure in X18 are plotted in Figures 

4.19 and 4.20, respectively. The values of L*(k,t) for actuator fail- 

1 

ures become very large after the failures occur. This is due to small 
value of the sensor noise variance as compared to the effect of the ac- 
tuator failures cn the model residuals. 

The presentation of the results of single actuator failures cor- 
responding to the second group of outputs concludes the simulation of 
single failures under a perfect modeling assumption (Fig. 4.3). In 
summary two sets of output sensors were selected and for each set 
three modes of failure were studied. In these simulations the failures 
were introduced separately in sensors and actuators. In the simula- 
tions corresponding to sensor set A (see Tables 4.1 and 4.2) the fail- 
ure occurs prior to the first detection test and in the case of set B 
the failure occurs after the initial detection test. This provides in- 
sight into the behavior of the GLR for various failure times. In the 
next section detection of multiple failures will be explored. The ob- 
jective is to evaluate the capability of the GLR technique in detecting 
multiple failures under perfect modeling. 

4.3.6 Multiple Sensor Failure Simulation 

During jet engine operation it is possible that two or more sensor/ 

actuator failures will occur simultaneously. The occurrence of two or 
more simultaneous sensor/actuator failures is referred to as a multiple 
failure. It is logical to expect that the detection of multiple fail- 
ures will be easier. The reason for such an expectation is as follows. 
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Any single sensor/actuator failure causes the mean of the residuals to 
deviate from zero. Thus the cumulative effects of multiple failures in- 
crease the deviation of the residual mean from zero further. 

Although detection of multiple sensor failures may be easier, iso- 
lation of such failures poses a problem. This is true since the exten- 
sion of the constrained GLR (CGLR) technique to the multiple failure 
case is not straightforward . This is due to the following reasons. The 
CGLR for single failure was derived by restricting the failure vector, 
v, to ufj where a is the failure size and fj is the jth vector 
direction. When CGLR is employed for single sensor failure isolation, 
fj has all zero elements except unity in the jth position (e.g. , see 
eq. (4-2)). Therefore, for single failures the number of possible fail- 
ure directions is equal to the number of sensors. But in the multiple 
failure case the number of possible failure directions can grow very 
rapidly. Another difficulty is the unequal size of failures in the 
failed seniors. That is, if the failure size is not the same in the 
failed sensors then the failure vector, v, can not be represented by 


An alternative approach to the problem of multiple sensor isola- 
tion is to use the estimate of the failure vector (eq. (2-37)). The 
elements of failure vect >r estimate associated with the failed sensors 
are substantially different from zero. Thus the failed sensors can be 
isolated easily. 

To evaluate the performance of the proposed GLR technique in a 
multiple failure application, multiple sensor failure simulation tests 
for QCSEE were performed. For these tests perfect modeling was as- 
sumed (Fig. 4. 3) and several combinations of sensor failures involving 
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at leant two or more sensors were simulated. To achieve the desired re- 
sults multiple sensor failures were induced in the nonlineur simulation 
program representing the engine and the resulting residuals were fed In- 
to the detection program. Since in the development of the CcR program 
no assumptions regarding the maximum number of failed sensors was made 
the program can be directly utilized. It should be noted that in all 
cases the failures were Introduced simultaneously. The results of these 
simulations are .summarized in Table 4. 5. The six sensors used to gen- 
erate these results are PSU , NL, Nil, P12, P4, and T3. The total num- 
ber of observations for each run is 26. The magnitude of the failure in 
each failed sensor is five times the standard deviation of the corre- 
sponding noise sequence. The first detection test in all cases is per- 
formed at the tenth (10) observation. The limits of the window around 
the failure time are N - 3 and M * 23. 

The results of Table 4.5 indicate that all multiple sensor failures 
are detected and the failure type is also identified successfully. For 
multiple failures which occur at the fifth (5) observation, the occur- 
rence of the failure is detected immediately after the first detection 
test. For these failures total detection time reflects the number of 
observations from the first detection test until the time and type of 
the failure is correctly determined. 

The values of the GLR index for multiple failure in PS11 and NL 
are plotted in Figure 4.21. Comparing this figure with Figure 4.22 (a 
single failure in PS11) reveals that the level of the GLR index for the 
multiple failure case is higher as was expected. It was remarked be- 
fore that CGLR may not be applicable for isolation in the multiple fail- 


ure case. 


It was also indicated that the estimate of the failure size 
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TABLE 4.5 

MU1 TITLE. SENSOR FAILURE SIMULATION RESULTS 

Sensor 1,2 1.2.1 1,1, 4,6 1,2, 1,4,5 1,2, 3, 4, 5. 6 

number 

Detected 1 1 3 1 1 

type 

Actual 5 5 10 5 12 

failure 

time 

Detected 5 5 10 5 12 

failure 

time 

Time to 0 0 

detection 

** ** ** 

Time to 1 1 2 0 2 

correct. 

type 

A* i k ** 

Total 113 0 3 

detection 

time 

Sensors PS11 “ 1, NL ■ 2, NH ■ 3, P12 ■ 4, P4 ■ 5, T3 * 6 

Simulation Number of outputs ■ 6 

inputs First detection test performed at tenth observation 

Total number of observations - 26 
Window limits M ■ 23, N ■ 3 
e * 34 

** 

Number of observations after the first detection test. 
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may bo used for the multiple f u 1 l u r * * 1 ho la t ion. The vector \> ( c*<j . 
(2-3/)) provides an estimate of the* failure size in the sensors corre- 
sponding to its various elements . Plot of these estimates lor I'Sll, 

NH, and T3 when multiple failures in I’Sll, NH, P12, and T3 have occurred 
are shown in Figures 4.23 through 4.25, respectively. 

An interesting observation can be made regarding these failures. 

It is evident that the estimate of the size of the failure In the speed 
sensor. Nil, is more accurate than the estimates (or I’Sll and T3 sen- 
sors. The reasons for such a dliference are as follows. It can be seen 
from the covariance matrix of the sensor noise sequences (see Appen- 
dix F) that the variance of the speed sensor is approximately 10 times 
smaller than the variance of the other sensors. Since this covariance 
matrix is used to generate the noise sequences for all three sensors, 
the pressure and temperature sensor residuals will have more Inherent 
variation around the mean and thus a less accurate estimate of the fail- 
ure sizes. 

Alternatively, it is shown in Appendix C that the GLR estimate of 
the failure vector is unbiased. Therefore, as more observations are 
taken the estimate of the failure vec! ir will approach the true failure 
vector. The rate by which the estimate will approach the true vector 
can be assessed by the variance of the failure vector estimate. It was 
shown in Appendix D that the covariance of the failure vector estimate 
is C~ 1 (k, t ) . In the proposed GLR, C _1 (k,t) has a simple form for sen- 
sor failures in time-invariant systems, 

- TTT v <4 ~ 3> 

Equation (4-3) was originally derived in Chapter IT (eq . (2-79)). It 
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foil ow h from equation (4-3) that as d ■ k - t grows the variation in 
the failure vector estimate will be reduced. Since in this case V, 
the covariance matrix of sensor noise sequences, is diagonal the rate 
of convergence of each element in the estimate vector is Independent of 
the other elements. The rate of convergence for each element, however, 
is dependent on the noise variance of the corresponding sensor. Hence 
the convergence for sensors with smaller noise variances will be fast- 
er. Specifically, the estimate of the failure size in NH will converge 
approximately 10 times faster than the estimates for PL11 and T3. 

4.3.7 Multiple Actuator Failure Simulation 

The capability of the proposed GLR detection technique for detect- 
ing multiple actuator failures was also tested by simulation. For this 
purpose both multiple jump and multiple step actuator failures were simu- 
lated. The results of those simulation runs are summarized in Table 4.6. 
In cadi I hr magnitude of the failure Is equal to '> 7 , of the nominal 

vaLue ol the- corresponding actuutors. The failures are introduced sim- 
ultaneously and the resulting residuals ar^ passed to the detection pro- 
gram. Perfect modeling assumed (i.e., configuration of Fig. 4. ’) and 
a total, of 26 residual observations are examined for failure detection. 
The failure time window limits are N * 3 and M ■ 23. The outputs 
used to generate the residuals are PS11, NL, NH, P12, P4, and T3. The 
first detection test is performed at the tenth (10) observation and the 
corresponding threshold is the same as before, namely e * 34. 

The results in Table 4.6 indicate that all failures are detected 
and the correct type of failure is identified. The detection and iden- 
tification of the failures in al^ cases requires five (5) or less 
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TABLE 4.6 


SIMULATION 

RESULTS 

FOR MULTIPLE ACTUATOR FAILURES 

Failed 

XMV 

XMV 

XMV 

XMV 

actuate rs 

X18 

X18 

THETA l 

X18 

X18 

THETA I 

Detected 

type 

1 

1 

2 

2 

A * 

Detected 
fa il ure 
time 

10 

1 0 

10 

10, 12, 13 

Actuai 

failure 

time 

10 

10 

10 

10 

Time to 
detection 

0 

0 

0 

0 

Time to 
correct 
type 

1 

1 

5 

0 

Total 
detecti on 
time 

3 

3 

5 

3 


J k 

Indicated as failure time only once in L7 estimates 
computed. 
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observations. The correct estimate of the failure time is obtained in 

all cases except when Jump failures are Induced in all three actuators. 

In this case, however, each of the two wrong estimates occurs only once 

in the total of 17 GLR tests performed. 

To illustrate the Increase in magnitude of the GLR index for mul- 

* * 

tiple actuator failures, plots of L-(k,t) for step and Jump failures 
in XMV, X18, and THETAI are plotted in Figures 4.26 and 4,27, respec- 
tively. Comparing these figures with Figures 4.19 and 4.20, respec- 

* A 

tively, confirms that the values of U(k,t) for multiple failures are 

i 

* * 

higher than L*(k,t) for a single failure. 

This completes the study of GLR performance under a perfect model- 
ing assumption. The results can be summarized in two parts. First, 
single failures were simulated in sensors and actuators separately. 

Two different sets of output sensors were tested. Second, multiple 
failures were simulated to assess the capability of the proposed GLR 
technique in detecting multiple failures. 

The overall results of all simulations indicate excellent GLR per- 
formance. Failures were detected in all cases and the proper failure 
types were determined. Specifically, for sensor failures not only were 
failures detected and isolated properly in all cases but also failure 
times were estimated without any error. However, for step failures in 
X18 and THETAI (and for multiple failures involving these actuators) 
small inaccuracies in estimating the time of the failure are encountered. 
It should be noted that the proposed GLR technique is developed for 
linear systems but the residuals used in the above cases are generated 
from nonlinear engine models. Although such an arrangement represents 
a realistic situation in which the proposed CLP. technique is applied 
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to the jet engine, the results will not be perfect because of the non- 
linearity of the residuals. Hence, the inaccuracies in the estimate of 
the failure time is attributed to these nonlinear effects in the resid- 
uals . 

The main restriction in the above simulations was that the engine 
model follows the engine perfectly. In the next section a linear model 
is employed to replace the nonlinear simulation representing the engine 
model in Figure A. 3. The resulting configuration will be identical to 
Figure 4.4. The objective will be to evaluate the effect of model de- 
gradation on the overall performance of the GLR technique, specifi- 
cally when a linearized model of the engine is used to generate the 
residual. Since the linear model does not follow the engine exactly, 
the discrepancy between the simulation model and the linearized model 
can be viewed as model degradation. 

The study of the effect of model inaccuracies on the performance of 
the GLR tests is also useful, because storage requirements and the over- 
all computation time requirements for an on-line GLR detection may often 
be severe. Since a complete simulation of the engine often requires 
large storage and high computation time, a simplified engine model can 
be used to reduce computational requirements. A linear model of the 
engine is one of the simplest forms of the engine model. The linear 
model will not model the engine perfectly however. Thus, it is impor- 
tant to investigate the impact of these modeling errors on the perform- 
ance of the GLR technique. 

4. 4 GLR Simulation with Model Degradation 

In this section the effect of model degradation on the performance 
of the GLR technique is studied. For this purpose the nonlinear Simula- 
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tion program representing the engine model is replaced by a linear state 
space model of the engine. Specifically the simulation results of this 
section are generated from a configuration identical to the configura- 
tion in Figure 4.4. The linear model used in this configuration is gen- 
erated from the QCSEE nonlinear simulation (see Appendix E). Since the 
linear engine model does not follow the nonlinear simulation of QCSEE 
perfectly, the discrepancy between the model and the simulation can be 
viewed as the model degradation. 

To study the performance of the proposed GLR under model degrada- 
tion, single and multiple sensor/actuatcr failures were simulated using 
the linear model. However, the model residuals calculated by subtract- 
ing the linear model output from the output of the nonlinear simulation 
model are no longer zero mean white Gaussian. This is due to the dis- 
crepancy between the linear model and nonlinear simulation of the 
engine. In this case application of the proposed GLR detection tech- 
nique to the model residuals (when no failure has occurred) resulted in 
declaring a failure. This occurs because the bias in the residuals 
caused by modeling inaccuracies is indistinguishable from the bias due 
to a sensor failure. Therefore, for studying the performance of the 
GLR under model degradation, the sensitivity of the detection technique 
to the model discrepancies should be reduced. 

The sensitivity of the detection technique can be reduced by two 
methods. The first approach is to increase the value of threshold to a 
level that GLR indices computed from the model residuals with no fail- 
ure would not exceed the threshold. This approach, while simple, is 
not always desirable because it is difficult to establish a guideline 
for increasing the level of threshold, e. Specifically, it is difficult 
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to establish a level for r. which will reduce the sensitivity of the 
detection technique uniformly. That Is, when the level of threshold is 
raised then the. Gl.R corresponding to output sensors which have higher 
discrepancies will exceed the threshold faster than the sensors with 
lower discrepancies. If the effect (magnitude) of model degradation Is 
approximately the same in all outputs then of course this approach can 
be utilized. 

The second approach is to Increase the elements of the covariance 
matrix artificially. That is, to enter a covariance matrix for model 
residuals into the detection program that has larger elements than the 
true covariance of the residuals. This method is more attractive than 
the previous approach because each element of the covariance matrix may 
be increased individually. Changing individual elements of the covar- 
iance matrix allows compensation of different levels of output discrep- 
ancies Another advantage of this method is that the amount of increase 
in each covariance matrix element can be estimated from the respective 
output discrepancy caused by the linear model. Following this approach 
the discrepancies between the linear model and the nonlinear simulation 
of QCSEE at steady state were determined. For this purpose identical 
inputs were applied to the linear model and the nonlinear simulation. 

The respective outputs were subtracted from each other to compute the 

3 

discrepancies. Each steady state discrepancy was approximately 10 
times larger than the standard deviation of the corresponding sensor 
noise level. This indicates that the lowest number by which the covar- 
iance matrix should be multiplied to avoid false alarms (due to model 
degradation) is approximately 10^. Hence, the covariance matrix must 
be multiplied by a larger number to provide a greater margin between 
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the GLR index and the threshold. This is necessary to avoid high false 
alarm rate as larger elements of the generated noise sequence together 
with imperfect modeling ef fects cause the GLR index to exceed the thres- 
hold. Thus the normalized covariance matrix was multiplied by 5x10 . 

The residuals computed according to the covariance matrix which 
was described above were tested by the GLR detection program (with no 
failure effect in the residuals). The plot of the GLR indices corre- 
sponding to this test is shown in Figure A. 28. Although the value of 
GLR index over the observation sequence does not exceed the threshold 
e , it shows an increasing trend in the indices. Comparing the pattern 
of the GLR indices in Figure 4.28 with plots of the GLR indices in Fig- 
ures 4.5 and 4.6 reveals the existing pattern more vividly. This 
trend is due to the model degradation effects on the residuals. Exper- 
ience from several trial simulation runs indicate that increasing the 
value of the covariance matrix elements reduces the magnitude of GLR 
Indices but does not remove the increasing pattern. This is indeed 
due to the fact that degradation in the model forces the mean of the 
residuals to deviate from zero and increasing the value of the el ment 
in the covariance matrix only reduces the sensitivity of the detec- 
tion technique. However, the reduction in the sensitivity of the GLR 
does allow performing the simulation of various failure modes without 
a forced false alarm due to model degradation. In the next section 
the simulation results for sensor failures are presented. 

4. 4. 1 Sensor-Step Failure Simulation 

To evaluate the performance of GLR in detecting sensor failures 
when model degradation occurs, simulation tests involving single and 
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multiple sensor failures were made. Specifically, single failures were 
introduced in the pressure sensor (PS11), the speed sensor (NL) , and the 
temperature sensor (13) separately. The same six outputs (i.e., PS11, 
NL, NH, P12, P4, and T3) as before were used to generate the residuals. 
The total number of observations used for these runs was 30 and the win- 
dow limits for failure time are M ■ 23 and N ■ 3. The threshold e 
was kept at 34 and the covariance matrix used in the detection program 
was computed as in Section 4.4. The failure size in the sensors is five 
tines the standard deviation of its noise. 

The results of these simulation runs are summarized in Table 4.7. 
The results of single sensor failures indicate that the step failures 
in pressure and temperature sensors are detected and identified prop- 
erly. However, the step failure in speed sensor, NL, is not properly 
identified. Although the type of the failure is not correctly identi- 
fied the occurrence of the failure is detected and the estimate of 
failure time is also correctly estimated in six (6) observations. 

When model degradation occurs the estimate of the failure size 
(computed by constrained GLR) is a combination of the estimate of fail- 
ure size and the output degradation effect on the sensor. For example 
the average estimate of failure size in PS11 over 14 estimation tests 
results is 5.142 and the actual failure size is 5.098; thus the differ- 

ence is 4.4*10 . The average effect of model degradation on the PS11 

- 2 

sensor calculated from residuals is 5.55*10 . The estimates of the 

failure size in PS11 are plotted in Figure 4.29. 

The speed of failure detection can be measured by time to detec- 
tion. From the results in Table 4.7 can be seen that although occur- 
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TABLE 4.7 

SIMULATION RESULTS FOR SENSOR FAILURES 


(With Linear Model) 


Failed 

sensor 

PS11 

NL 

T3 

NH 

P12 

T3 

PS11 P12 
NL P4 

NH T3 

Detected 

type 

3 

1,3 

3 

3 

3 

Detected 

failure 

time 

12 

12 

12 

12 

12 

Actual 

failure 

time 

12 

12 

12 

12 

12 

■k 

Isolation 

C 

— 

C 

— 

— 

Failure 
timj from 
isolation 

12 

" 

12 



Time to 
detection 

5 

3 

2 

2 

1 

Time to 
correct 
type 

5 


15 

2 

2 

Total 

detection 

time 

5 

— — 

15 

3 

3 


*C correct isolation. 
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rence of a failure is detected rapidly more observations are required 
before the correct type of failure is identified. A comparison between 
the number of required observations to correct type for single sensor 
failures and multiple failures indicates that multiple failures are de- 
tected more rapidly than single failures. These results are similar to 
the results obtained under perfect modeling. Higher speed and accuracy 
of detection and estimation of multiple failures are attributed to the 
more intensive effect of the multiple failures on the residuals. The 
multiple failure simulation results in Table 4.7 show accurate estima- 
tion of the failure time. To illustrate the evolution of the GLR index 
for single and multiple failures the Indices for a single sensor failure 
in PSll and multiple sensor failures of all six sensors are plotted in 
Figures 4.30 and 4.31, respectively. Again the index in the multiple 
failure case rises more rapidly. Next, detection of actuator failures 
under model degradation is discussed. 

4.4.2 Actuator Failure Simulation 

The performance of the GLR detection technique with imperfect 
modeling was evaluated by simulating single and multiple actuator fail- 
ures. The results of these simulation tests are presented in Tables 4.8 
and 4. 9, respectively. The failure size for these tests are 5% of the 
input for step failures and 20% of the input for jump failures. Each 
simulation is performed over a total of 30 observations and the window 
limits for failure time are set as N = 3 and M = 23. The level of 
threshold c is maintained at 34 but the covariance matrix of the re- 
siduals is computed according to the same procedure that was explained 
in Section 4.2. 


Consider the results of single actuator failure simulations in 
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TABLE 4.8 

SIMULATION RESULTS FOR ACTUATOR FAILURE 


(Linear Model) 




Step failure 


Jump failure 

Failed 

actuacor 

XMV 

X18 

THETAI 

XMV 

X18 

THETAI 

Detected 

type 

1 

1 

1 

2 

2 

1,2 

Detected 

failure 

time 

12 

12 

11,12 

12 

11 

11,12 

Actual 

failure 

time 

12 

12 

12 

12 

12 

12 

Time to 
detection 

0 

3 

0 

0 

3 

0 

Time to 
correct 
type 

10 

7 

0 

1 

3 


Total 

detection 

time 

10 

7 


3 


“ ”■ 
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TABLE 4.9 

SI ELATION RESULTS FOR MULTIPLE ACTUATOR 
(Linear Model) 


Step failure dump failure 


led actuators 

XMV 

THETA! 

XMV 

X18 

THETA! 

X1R 

THETA! 

XMV 

X18 

THETA I 

Detected 

type 

1 

1 

2 

2 

Detected 

failure 

time 

9,10,11,12 

10,11,12 

12 

12 

Actual 
f ai lure 
time 

1? 

12 

12 

12 

Time to 
detection 

0 

0 

0 

0 

Time to 
correct 
type 

0 

0 

1 

1 

Total 
detect ion 
t ime 

— 

— 

r > 

i 


J 
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Table 4.8. For thaae simulations the type of the failure is accurately 
determined except for the jump failure In THETAI. However, for this 
case the number of times that the failure type is correctly determined 
as a Jump failure by far exceeds the number of times that the failure 
type is erroneously identified. Specifically, from the total of 18 de- 
tection tests performed, 14 test results indicated that the failure is 
a jump failure. 

The estimate of the failure time is accurately determined for all 
cases. The largest error in the estimate of failure time is one obser- 
vation. In the case of a step failure in THETAI only four out of 16 
failure time estimates were incorrectly estimated as 11. The remaining 
12 were correctly estimated. Exactly the same results were obtained for 
a jump failure in THETAI. 

The actuator failures are detected rapidly in all cases. Maximum 
delay in detecting the failure is three (3) observations. Identifica- 
tion of the type of the failure, however, requires more observations. 
Finally, it should be mentioned that when a failure type or time is not 
correctly estimated then no number appears in the boxes corresponding 
to the time to correct type or detection time. The plots of GLR indices 
for step and Jump failures in THETAI are shown in Figures 4.32 and 
4.33. 

Consider the results of multiple failure simulations in Table 4.9. 
The failure type has been detected successfully in a LI cases. The es- 
timate of the failure time for step failures are not as accurate as in 
the case of no model degradation. Specifically, for the case of multi- 
ple failures in XMV and THETAI the failure time is estimated as 9 and 10 
once and as 11 twice in the total of 16 estimates. Similarly, for step 
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failure in all three actuators the time of failure is estimated as 10 
once and as 11 three times. Nonetheless, In both cases the majority of 

the failure time estimates are equal to the actual failure time. 

Due to more intensive effects of multiple failures on the model re- 
siduals the time to detection for multiple failues is less than the time 

to detection for single failures. The evolution ot the GLR indices for 
multiple sten and jump failure in all three actuators are plotted in 
Figures 4.34 and 4.35, respectively. Comparing the plots in Figures 
4.34 and 4.35 with the plots in Figures 4.32 and 4.33, respectively, re- 
veals the increase and rapid rise of the GLR indices for multiple fail- 
ures. 

The study of performance of the GLR detection technique under model 
degradation is concluded at this point. In this study the performance 
of the GLR technique for single and multiple sensor/actuator failures 
was evaluat'd.' . For this purpose various performance measures such as 
correct failure type detection, estimate of the actual failure time, 
time to detection, and total detection time were used. Tables 4.7 
through 4.9 provide a summary of the complete results o f the performance 
evaluation tests. Next a summary and discussion of the results of this 
chapter will be presented. 

4,5 Summary and Discussion 

Simulation tests were conducted to evaluate the performance of the 
GLR detection technique in a realistic and practical environment. Spe- 
cifically, the GLR technique was applied to a Quiet Clean Short-Haul Ex- 
perimental Engine, QCSEE. The simulation studies were carried out by 
utilizing a reasonably detailed nonlinear digital simulation of the QCSEE 
engine. The QCSEE digital simulation was developed by NASA for utiliza- 
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tion in a flight simulator for STOL flight tests. The simulation pro- 
gram has been tested against a highly detailed digital model of the en- 
gine and the results match very well. For failure detection simulation 
studies a linear discrete state space representation of the engine and 
engine sensor noise characteristics are required. 

The linear model of the engine was generated from the engine simu- 
lation (see Appendix E) and the sensor noise characteristics were ex- 
tracted from actual engine measurements of an F-100 engine. The use of 
F-100 sensor noise characteristics is justified on the basis that simi- 
lar sensors are used for measuring comparable engine parameters in jet 
engines. Another main assumption in this regard is that the noise char- 
acteristics of sensors measuring analogous engine outputs are identical. 
For example, noise characteristics of all QCSEE pressure sensors art 
assumed to be the same. 

To conduct the failure detection simulation tests, a digital com- 
puter program incorporating the GLR concept was developyd to examine the 
model residuals for failure detection. The program is capable of de- 
tecting a failure , identifying the type of the failure, and estimating 
the failure time. Isolation of single sensor failure Inside the pro- 
gram is achieved by utilizing the concept of the constrained GLR. ror 
multiple sensor failure isolation, the estimate of failure vector is 
used. The underlying idea for this approach is to associate the failed 
sensors with the nonzero elements of the failure vector. Incidently, 
estimates of failure vector are also useful for failure accommodation. 
The GLR program has been extensively tested by numerous simulation 
tests. 

At first the consistency of the GLR program was examined by test- 
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ing the model residuals when no sensor/aotuator failure was present. 

The results indicate that no false alarm was encountered. Specifies < • y , 
it follows from Figures 4.6 and 4.7 that the level of threshold, i , re- 
mained substantially higher than the maximum value of the GLR index 
over the observation range. Another interesting result from these fig- 
ures is that lowering the level of i Increases the probability of 
false alarm. The consistency tests were carried out by utilizing 
model residuals generated from the simulation configuration of Figure 
4.3. For easy reference this configuration is referred to as perfect 
modeling configuration or in short, perfect modeling. 

After consistency tests the capability of the GLR technique in 
detecting sensor/actuator failure was tested. To conduct these tests 
the perfect modeling configuration was employed first. This configu- 
ration provided a realistic performance evaluation of the detection 
technique for situations in which the model follows the engine without 
any discrepancies. Alternatively, testing the GLR technique (which 
originally is developed for linear systems) with the nonlinear QCSEF. 
simulation provides a more realistic evaluation of the performance of 
the technique. The results of failure detection tests with regular 
modeling configuration is referred to as the first test category. The 
second test category consists of failure simulations in the presence oi 
some discrepancy between the model output and the engine (Fig. 4.4). 

This is re ferred to as imperfect mode Ling configuration. 

Under perfect modeling two sets of single sensor and actuator 
failure tests were conducted. The summary of the results of these 
tests are reported in Tables 4.1 through 4.6. Examination of the re- 
sults reveals an impressive performance by the GLR detection technique. 
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Particularly, all single sensor failures were correctly detected and 
isolated. Also the failure t imes in all sensor failure cases were cor- 
rectly estimated. The speed of detection in all cases was high such 
that the failed sensor was completely identified in nine (9) observa- 
tions or less. Here complete identification refers to the correct fail 
ure detection, isolation, and proper estimation of the failure time. 

The estimates of failure size in the sensors were also computed accur- 
ately. Similarly, all single actuator failures were detected and the 
correct failure types were identified. The estimates of failure time 
for all cases were also correctly determined except for step failure in 

the fan pitch angle and fan nozzle actuators. However, the inaccura- 
cies in these estimates do not exceed two observations. In addition, 

the frequency of the correct estimates of failure time exceeds the fre- 

quency of incorrect estimates (see, e.g.. Figs. 4.10 and 4.11). 

Under perfect modeling the capability of the GLR technique in de- 
tecting multiple sensor/actuator failure was also examined. As expec- 
ted the effects of multiple failures on the residuals were stronger 
and therefore the failure detection was accomplished faster. It 
should be mentioned that since any single actuator failure affects the 
output of all sensors, multiple sensor failure residuals might resem- 
ble the residuals of single actuator failure. As a result cross de- 
tection may occur. However, the results of multiple failure analysis 
for QCSEE indicate that the proposed detection technique successfully 
identified all the multiple sensor failures. In addition the failure 
time and size were correctly identified in all cases. Similarly, the 
performance of the detection technique in detecting multiple actuator 
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failures is Impressive (see Table 4.6). The technique Identified all 
the multiple actuator failures with a very short delay in detection 
(the maximum delay was five (5) observations). Estimates of failure 
time were accurately calculated in all cases except for multiple jump 
failures in three actuators. It should be noted, however, that each 
of the two wrong failure time estimates occurred only once in a total 
of 17 estimate calculations. 

To evaluate the performance of the GLR technique further the second 
category of tests with model degradation were carried out. The objec- 
tive of these tests was to study the role of the engine model in succes- 
ful detection of the sensor/actuator failures. To achieve this, a lin- 
ear model of the engine was generated and substituted for the nonlinear 
simulation representing the engine model. The linear model was gener- 
ated from the simulation program and it follows the simulation model 
closely. However, the model residuals generated from the linear mode! 
would no longer be zero-mean white noise. Therefore, the sensitivity 
of the detection program must be reduced to avoid false alarms due to 
model degradation biases. This sensitivity reduction was achieved by 
increasing the values of the elements of the sensor noise covariance 
matrix. 

After reducing the sensitivity of the detection technique a series 
of simulation tests were conducted. The results of these tests ar<' 
summarized in Table 4.7. These results indicate that even when a lin- 
ear model is utilized the detection results are quite satisfactory. 

The sensor failure simulation results in this category indicate that 
with the exception of failure in the fan speed sensor ail other failures 
were correctly detected. Several interesting observations can be made 
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by comparing the results of sensor failure simulation of perfect and 
imperfect modeling. For instance the results of failure tests for PS11 
and T3 in Tables 4.3 and 4.7 reveals that iii case of model degrada- 
tion the failure detection is slower. However, this reduction in de- 
tection speed is due to lowering the sensitivity of the GLR detection 
program rather than model degradation. Alternatively it can be conjec- 
tured that increase in the delay to correct failure type is due to the 
model degradation effects. Specifically, the modifications of the co- 
variance matrix in the GLR detection program effect the GLR indices of 
all three failure types equally. Similar comparison can be made be- 
tween the simulation results of multiple failure of all sensors in 
Tables 4.5 and 4.7. It follows from this comparison that longer delay 
in detection under imperfect modeling was not encountered. Thus it 
follows that multiple failures accentuate the change in the residual 
mean and thus they compensate for the reduced sensitivity of: the de- 
tection program. 

The performance of the GLR in detecting single and multiple actua- 
tor step and jump failures with imperfect modeling was also evaluated. 

A summary of these results is in Tables 4.8 and 4.9. For sing^ actua- 
tor failures all failures were successfully identified except the jump 
failure in THETAI. Comparing the results in Table 4.8 with t’K perfect 
modeling actuator failure simulation results in Table 4.4 indicates 
that longer delay in detection under imperfect modeling were encoun- 
tered. This confirms the previous conclusion that longer time to de- 
tection is due to reduction in the sensitivity of the detection program. 
It also follows from the results in Table 4.9 that the estimates of 
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failure time contain small inaccuracies which do not exceed one samp- 
ling interval. 

Multiple actuator failure results in Table 4.9 indicate that the 
intensive effects of multiple failure again eliminate the delay in fail- 
ure detection. In addition the failure types are also correctly identi- 
fied (no cross detection). The estlmatt of failure time, however, con- 
tinues to show Inaccuracies. Compared to the results in Table 4.6 the 
frequency of inaccurate failure time estimate, in Table 4.9, increased 
under imperfect modeling while the error range is the same for both 
test categories. Another comparison which can be made between the re- 
sults in Tables 4.6 and 4.9 concerns total detection times. It can be 
seen that for jump failures the total detection time are equal for the 
two test categories. 

It should be emphasized that even under imperfect modeling the CLR 
technique performs quite satisfactorily. These performance results war- 
rant further investigation into the use of imperfect models in the pro- 
posed technique. The use of simpler but imperfect model can broaden 
the application of GLR to complex systems which require very detailed 
and complicated modeling for perfect reproduction of their dynamics. 

In summary the GLR performance evaluation tests indicate that 
the proposed detection technique is a reliable, consistent, fast, and 
accurate method of detecting failures. In addition it provides all the 
necessary information regarding the size, time, and type of failures. 

The proposed GLR technique is also capable of isolating failed sensors 
and it furnishes the required information for accommodating the failure. 
The problem of failure accommodation is studied further in the next 
chapter. 



CHAPTER V 


FAILURE ACCOMMODATION 

5.1 Introduction 

The last phase of the proposed failure analysis, namely failure 
accommodation, is discussed in this chapter. As it was indicated in 
the first chapter i failure accommodation techniques are closely 
related to the system control design methodology. The accommodation 
technique, proposed in this Chapter, is based on the Multivariable 
Nyquist Array (MNA) technique. Hence, it is compatible with the 
proposed GLR failure detection and isolation techniques and completes 
the proposed failure analysis technique. The concept of failure 
accommodation and its relation to the MNA failure technique is described 
in Section 5.2. Also in Section 5.2 the concepts of the MNA technique 
that are utilized in the development of the proposed accommodation 
technique are discussed. Then in Section 5.3 the proposed accommodation 
procedure is described. Examples of the accommodation procedure for 
the QCSEE engine are presented in Section 5.4. Finally, in Section 5.5 
a summary am. discussion of the results are presented. 

5.2 Failure Accommodation 

The significance of sensors in successful control of jet engines 
was discussed in Chapter I (Section 1.3). It follows from the discus- 
sion that a sensor failure may degrade the overall performance of the 
engine. Thus, after a failure has been detected and isolated it is 
necessary to take corrective actions to minimize the performance 
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degradation (i.e. to accommodate the (allure). Based on the proposed 
failure analysis technique (see Section 2.2), failure accommodation 
may be achieved in two alternative fashions. First, the control 
system remains unchanged and the lost measurement is replaced by the 
corresponding model output. In the second method the system control 
design is altered to minimize the performance degradation. The imple- 
mentation of the first method is straightforward. However, the replace- 
ment (or reconstruction) of the lost measurements is not always practi- 
cal. Therefore, the second accommodation technique must be developed. 
Such a development for the proposed failure analysis technique is 
based on the MNA design methodology. Therefore, it is helpful to 
review the MNA concepts essential to the development of the accomoda- 
tion technique. 

5.2.1 MNA Design Technique 

The use of Nyquist stability criterion in classical control 
theory for single input single output systems is well established. 

In 1969, Professor H. H. Rosenbrock proposed an extension of the 
NyquisL criterion to multivariable systems (Ref. 17). In his paper, 
Rosenbrock utilized the cone >pt of diagonal dominance for the linear 
system transfer function matrices in the inverse polar plane to 
develop the Nyquist stability theory for multivariable systems. Since 
the stability theory was developed for the inverse polar plane, it 
is referred to as the Inverse Nyquist Array (LNA) method. The Nyquist 
stability theory for the direct polar plane was inLroduced by Rosenbrock 
in 1974 (Ref. 18). Likewise, this method is referred to as the Direct 
Nyquist Array (DNA) method. 

Being natural extensions of the classical control techniques, 
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both INA and DNA have been examined by researchers (see, e.g., Refs. 

19 to 21, 23, and 24). This has produced significant results which 
enhances the understanding and applicability of these techniques. 

One such result is due to Leininger (Ref. 24) who has shown tho.t it 
is possible to achieve dominance in either the direct or inverse plane 
and complete the design in the opposite plane, thus unifying the INA 
and DNA under a single heading as the "Multivariable Nyquist Array" 
(MNA). In applying MNA to any system the main concern is to achieve 
dominance in either polar plane. Once dominance is obtained the design 
of individual feedback loops can proceed in the same fashion as in 
single input single output systems. Hence, it is of great importance 
to achieve dominance in a fast relirble fashion. 

To understand the concept of dominance consider the system block 
diagram in Figure 5.1. In this diagram G(S) is the n x n system trans- 
fer matrix, and K(S) and L(S) are two n x n pre- and post-compensators, 
respectively. The n x n diagonal matrix F(S) represents the feedback 
gain matrix. The open-loop transfer function matrix, Q(S), in the 
direct polar domain is given by 

Q(S) = L(S)G(S)K(S) (5-1) 

In the inverse polar plane the open- loop transfer matrix is given by 

Q(S) = K(S)G(S)L(S) (5-2) 

<j(S) = cf\s) 

Q (S T - Q~ 1 ( S ) 

K(S) = K~ 1 ( S ) 

L(S) = L _1 (S) 


who re 
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To proceed with the feedback gain design either Q(S) or Q(s) 
must be diagonally dominant. The definition of the diagonal dominance 
can be expressed in a more unified and general fashion as follows. 

Let P(S) represent the general open loop transfer function matrix, 
given as 

P(S) « A (S)Z (S) B (S) (5-3) 

Where A(S) and B(S) are the pre- and post-compensators or their 
proper inverse depending on the plane in which the dominance is sought. 
Likewise Z(S) represents either G(S) or G(S) and P(S) becomes 
Q(S) or Q(S). Now using equation (5-3) the concept of diagonal domi- 
nance for rows and columns of P(S) can be defined. 

y* Q 

Definition: Let P(S) be a rational polynomial matrix and 0^ and 0^ 

be determined for all i = l,2,...,n by 
n 

6 r - Max V |p (S)| / I P,.(S)| (5-4) 

1 SeD ^ 1 iJ / 1 11 1 

j-1 

j/i 

and 


= Max 


SeD : , 
J = 1 
j^i 


it 

2;V S> ’ '’ii 


(S) 


Where D is the Nyquist contour. Then 
all i = 1,2,. . . ,n 


< 1 


(5-5) 


P(S) is row dominant if for 


(5-6) 


and P(S) is column dominant if for all i = l,2,...,n 
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( 5 - 7 ) 


The functions defined in equations (5-4) and (5-5) are called row 
and column dominance levels, respectively. 

For an MNA design to proceed row or column dominance in either 
direct or inverse plane is sufficient it follows frcm the above 
definition of diagonal dominance that there are twelve possible MNA 
design forms wherein A(S) or B(S) can be specified or varied to 
achieve dominance. Therefore, it is of interest to establish a 
relationship between the dominance in the direct and inverse polar 
plane. In the course of the research for this dissertation a new 
relationship between the dominance in the two polar planes is 
established . The theorem establishing this relationship utilizer, 
a theorem provided by Rosenbrock (P.ef . 52). For easy reference 
Rosenbrock's theorem is repeated here without the proof. 

Theorem 5.1: Let the nxn complex matrix Q satisfy 



Where 0^0^<1 for i = i,2,...,n. Then Q has an inverse 
** -1 

Q = Q satisfying 


q jiK V 

Respectively 


q ijK°j : q n 


(5-8) 


(5-9) 


£ 
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TV 


For 1 m 1,2, ... ,n And J " 1,2,. ■ . , 1 - 1, 1+ 1 , • . • , n 
Proof: Set* reference 52, Chupter 5, Section 6.1. 

Now "(fll/liiK theorem 5.1 the dominance roiitlllioim In I lie d I mm I 
.ind Inverse piano ran be llnkod by tin- lot lowing I licor <'in. 

I’hooreni 5.2 If an n * n transfer matrix <)(S) 1“ row (column) 
dominant then Q (S) Is column (row) dominant if the sum of any n - 1 
of the dominance levels is less than unity. 

Proof: Note that if Q(S) is row dominant then equation (5-8) is 

satisfied for all S on the Nyquist contour, D. It follows from 
theorem 5.1 that the equation (5-9) is also valid for ScD Then the 
dominance levels of Q(S) can be expressed in terms of 0^ as follows: 


„ r 

U i 


( 


Max 0 

SeD 


(5-10) 


Respectively 0 = Max 0 

1 SeD 


■) 


for 1 = l,2,...,n. Now consider the equation (5-9), adding the inequi- 
ties for all possible j^i yields 


II II 

Z hikZ 3 ji q iii 


(5-11) 


j = l 
j^f 


j=l 

j^i 


( 


Respect i vely 


Zi q ui<Z °j km ) 

j-i j-: ' 

j#i j^i 


Note tliat trom the conditions of the theorem 
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j-i 

J*1 


) 


then It follows from (5-10) that 
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(5-13) 


Therefore, it can be seen from (5-11) that Q (S ) is column (row) dominant. 

Theorem 5.2 provides a method of testing for dominance in either 
direct or inverse polar plane after the dominance condition is satisfied 
in the opposite plane. It also follows from theorem 5.2 that the 
dominance levels satisfying the conditions of the theorem, automatically 
provide the freedom of completing the design in either of the polar 
planes. Having established the definition of diagonal dominance, the 
methods of achieving dominance can now be considered. 

Three alternative methods of achieving dominance have been proposed 
by the researchers. Rosenbrock introduced the concept of pseudo 
diagonalization (Ref. 18) and Schafer and Sain developed (Ref. 54) a 
dominance seeking graphical technique, called CARDIAD plots. However, 
both these techniques emphasize the selection of compensator parameters 
by the designer through a trial and error procedure. Thus they require 
excessive time for obtaining dominance. The third approach introduced 
by Leininger (ref. 20) is based on a function minimization procedure. 
This method utilizes a conjugate direction function minimization 
technique to adjust the parameters of the compensators to obtain the 
dominance conditions (eqs. (5-6) and/or (5-7)). The function 
minimization technique has been successfully applied to r-unerous 
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practical problems (Kef. 19). 

The function minimization method transfers the task of obtaining 
dominance to the computer and requires minimal intervention on the 
designer's part in achieving dominance, hence allowing the designer to 
devote more of his time to the design of the feedback gains. Tn 
addition, due to lack of reed for continuous intervention by the 
designer, the technique can be implemented in a batch mode. These 
attractive features of the functional minimization technique are 
particularly useful for failure accommodation, as alternative design 
configurations can be generated faster. 

One of the main assumptions in the development of the MNA 
technique is that the system under study has an equal number of Inputs 
and outputs; namely the system is square. However, when a sensor/ 
actuator failure occurs it may not be possible to utilize an equal 
number of inputs and outputs in the control design. Hence a pro- 
cedure must be developed to make the MNA technique applicable to non- 
square systems. A procedure for this purpose is proposed in the next 
section. 

5.3 Failure Accommodation Technique 

In this section a method of failure accommodation based on the 
MNA design technique is developed. The main objective is to develop 
a procedure that will make the MNA design technique appl icable to non- 
square systems. Since the MNA design technique is developed for 
square systems, the procedure entails converting the nonsquare systems 
to square configurations. This may be achieved by designing pre- and 
post-compensators of proper dimension so that the open-loop transfer 



148 


ORIGINAL PArn 13 
OF POOR QUALITY 


(}(S); however, an n x n Q(S) resulting from u G(S) of rank n - 1 
cannot he made dominant. This can be neon by examining the rank of 
*J(S). Since the rank of (}(S) cannot be raised above the tank of G(S) 
through matrix multiplication, then the rank of Q(S) I s at most n - 1 
Therefore, the eigenvalues of Q(S) include at least one zero. Now, 
according to Greshgorin Theorem (Ref. 55) the union of Greshgorin discs 
for Q(S) (for any S) contain all the eigenvalues of Q(S). Therefore 
for all values of S on the Nyquist contour the Greshgorin discs sweep 
out a band which contains all the eigenvalues of Q(S) (for S on D) . 
This band is referred to as Greshgorin band. For the dominance condi- 
tions (eq. (5-6) or (5-7)) to be satisfied, the Greshgorin band must 
exclude the origin (Ref. 18). Hence, to obtain dominance the compensa- 
tors should be selected such that the dimension of 0(S) will be equal 
to n - 1. 

It follows from the above discussion that for failure accommoda- 
tion the system transfer matrix should always be squared down to the 
lower dimension of G(S). Thus far it has been established that the 
1NA design is not suitable for failure accommodation and the DNA design 
can only be carried out by squaring the system down to its lower 
dimension. Hence, it remains to develop a dominance-seeking procedure 
for DNA design that will yield a square system of dimension n - 1. 

The method of function minimization is utilized to obtain domi- 
nance for nonsquare systems. To describe the technique, consider the 
open-loop transfer matrix in equation (5-1). Now suppose that a sensor 
has failed, then G(S) becomes an (n - 1) * n matrix. Thus, to 
obtain dominance L(S) should be an (n - 1) * (n - 1) matrix and K(S) 
must be an n x (n - 1). Note that depending on the type ot dominance 
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(l.f. row or column) .mcl whether K(S) and I . (S ) arc specified or 
variable, there are .six possible UNA design forms. The purpose of any 
of these designs is to obtain dominance levels (eq. (V-6) and (5-7)) 
below unity. It Is remarked that the dominance levels for several of 
these forms can be adjusted by varying only one row (or column) of 
the compensators. For Instance, consider the case of row dominance 
when K(S) is specified and I.(S) is varied. It follows from equations 
(5-1) and (5-4) that the elements in the ith row of L(S) do not ef- 
fect the dominance levels of the remaining rows. Based on this obser- 
vation, two separate functions can be specified for the function mini- 
mization technique as 


.1 


1. 



(Row) 


(Col umn) 


and 


(5-14) 


r Ma.; (o' - ) 


.1 


2 




Max (qS 
i ‘ 


(Row) 


(Column) 


(5-15) 


V. 

r c 

where 0^ and 0^ are given in equations (5-4) and (5-5) respective- 
ly. Equation (5-14) is used whenever the rows or columns of the 
unspecified compensator et feet the corresponding dominance levels 
independently. Alternatively, equation (5-14) is utilised when such ^ 
independence does noL exist. Whenever .1^ can be used, the unknown 
parameters ol individual rows or columns are computed to minimize d^. 
Thus, at most n unknown parameters are computed to extremize 
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for each dominance level. For the design corresponding to equation 
(5-15) all the unknown coefficients are adjusted to achieve low over- 
all dominance levels. Therefore, the number of unknown parameters 

2 

used in extremizing the dominance levels is at least (n - .1) and 
at most (n - l)(2n - 1). 

The optimization technique selected to minimize J and J„ 

is a conjugate direction technique developed by Zangwill and Powell 
(Refs. 56 and 57). The technique is particularly suitable tor mini- 
mizing and J ^ functions because it does not require an explicit 

evaluation of the gradient, as the calculation of the gradient of 
these functions may pose some numerical problems. Additionally, 
Fletcher, in his comparative study of optimization techniques tRef. 

62) concludes that ar.mg the techniques which do not require the calcu- 
lation of the gradient Powell’s technique may be computationally the 
most efficient. 

After minimizing the functions in (5-14) and (5-15), the 
resulting dominance levels are usually of different magnitude. 

Indeed, often the resulting dominance levels for certain rows (or 
columns) are less than unity and for the remaining rows (columns) 
exceed one. In this case the DNA design still cannot be completed 
until all the dominance levels are less than one. Leininger has 
shown (Ref. 24) that it is possible to share the dominance between 
rows (columns) . The concept of dominance sharing can be described by 
examining the open-loop transfer function Q(S) in (5-1). Suppose 
that it is desired to achieve column dominance for Q(S), and the 
function minimization technique has been applied and the resulting 
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dominance level s are unequal. Then Q(S) i .3 premultiplied by a 
diagonal T = dlg(t^) Cor i = 1,2,..., n - 3. The resulting matrix 
is given by 

R(S) «= TQ(S) - TL(S)C (S)K(S) 
or 

i q ll t l q 12 t l ' * • q l(n-l) t l 

q 21 t 2 q 22 t 2 ' * * q 2(n-l) t 2 I 

R(S) - 

• • • • 

• • • • 

• • • « 


q (n-l)l t (n-1) q (n-l)2 t (n-l) q (n-1) (n-1) C (n-1) 

I 

(5-16) 

It can be seen from the above equation that by selecting t^ for 
i= 1,2,..., n - 1 the dominance levels in R(S) can be varied. It 
is also possible to establish a set of sufficient conditions that will 
provide a guideline for selecting t^’s such that the dominance is 
shared while it is still retained in the rows (columns) that are 
already dominant (Ref. 24). However, it is practically more feasible 
to employ the concept of function minimization technique to select the 
diagonal elements of the T matrix. This may be achieved by minimi- 
zing the following function 



i x, 2, . . . ,n — 1 


(5-17) 


c 

where y is the column dominance level for R(S) . If the minimiza- 
tion of (5-17) is continued until the lowest value of J 


is obtained, 
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(* 

then y for i = 1,2,..., n - ] will become equal. Similarly, 
i 

when row dominance is desired, the Q (S ) Is postmul Liplied by 
T * dig(t^), then, R(S) in this case becomes 
R (S) =* Q(S)T - L(S)G (S)K(S)T 


q ll t l q 12 C 2 

q 21 t l q 22 t 2 

R(S) 


q (n-l)l t l q (n-l)2 C 2 


q l(n-l) t (n-l) 

q 2(n-il t (n-l) 


q (n-1) (n-1) C (n-1) ! 

(5~18) 


To obtain dominance the following function is minimized 



Where y are the row dominance levels for R(S) in (5-19). 
i 

Utilizing the failure accommodation technique developed in this 
section, a digital computer program capable of obtaining dominance for 
nonsquare systems was developed. The performance of the program was 
then tested by using the QCSEE linear mode] at 62.5% power. The result 
of these tests are reported in the following section. 

5.4 Performance Evaluation of Failure Accommodation Technique 


A digital computer program for implementation and evaluation of 
the preposed failure accommodation technique was developer.. The main 
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purpose of the program was to provide the capability of obtaining 
dominance for nonsquare systems. However, the program is designed 
such that it can be utilized for squ. ^ systems as well. In addi- 
tion, various forms of MNA designs can be examined by the program for 
obtaining dominance. That is for square systems both INA and DNA 
row and column dominance can be examined. 

For nonsquare systems, row and column dominance in the DNA mode 
can be tested. The dominance-seeking logic of the program is based 
on the function minimization technique that was described in the 
previous Section. In addition, the concept of dominance sharing is 
implemented in the program logic. 

Although the main objective of the program development is to 
demonstrate the capability of obtaining dominance, the program has 
the capability of plotting Greshgorin and Ostrowski bands. These 
bands are used to complete the DNA design. Graphically the Greshgorin 
and Ostrowski bands are plotted by utilizing Crossley's (Ref. 63) 
envelope curves, hence saving a significant amount of time in plotting. 

For performance evaluation the proposed accommodation technique 
was applied to the QCSEE with unequal number of inputs and outputs. 
Specifically, two categories of tests were conducted. In the first 
category the number of outputs is smaller than the number of inputs. 
This group of tests represent a case of sensor failure wherein the 
system must be reduced to the nonsquare system. The second category 
of tests examine the system with fewer inputs than outputs; they 
represent actuator failures. One example from each of the two test 
categories will be presented here. 



For the case of a sensor failure, three inputs and two sensors 


are utilized. The inputs are XMV, THliTAI, and X18 and the two 
sensors are NL and NH (for a description of inputs and outputs 
see Section 4.1.2 in Chapter IV). The dynamics of the sensor are 
neglected in this case. Column dominance is sought over the range 
of zero to 50 Rad/s divided into 100 equally spaced points. The 
initial pre- and post-compensators are 



( 5 - 20 ) 


and 


0 


( 5 - 21 ) 


0 1 

The dominance levels resulting from the above compensators are 


0 ^ = 3.193 


(] C 2 = 54.259 ( 5 - 22 ) 

To obtain dominance, the post-compensator is kept constant and the 
elements of the pre-compensator are varied to get dominance. It is 
remarked that for this DNA design form, changing the elements in the 
column L of K for i - 1,2 effects only the ith dominance 
level of Q(S). 

After a single application of the function minimization pro- 
gram, the following values for the pre-compensator result. 
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( 0.10157 

0.81920 x 10 3 

0.82020 x ]0 3 


Q. 31457 x IQ 6 
-0.67101 x 10 


- 1.0 


and the associated dominance levels are 


0 [ - 0.09582 

0^ *= 0.6125 


(5-23) 


(5-24) 


It can be seen that although diagonal dominance is obtained with the 

c c 

new K, dominance level 0^ is six times larger than 0^ in (5-24). 

Using the dominance sharing option of the program, the following T 
matrix is computed 


( 0.49638 

0.0 



(5-25) 


which results in 

0^ = 0.24227 

0^ = 0.24226 

L* 


(5-26) 


Now if the post-compensator, L, in (5-21) is premultiplied by T in 
(5-25), a new post-compensator is obtained. Using the new compensator, 
the function minimization and dominance sharing is repeated twice and 
the following dominance levels result 

0^ = 0.099509 


(5-27) 


= 0.099502 


The corresponding T matrix is 
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(5-28) 



an identity matrix; hence, multiplying L by T will not change L 
significantly. This implies that repeating the function minimization 
and dominance sharing will not change the dominance levels signifi- 
cantly. It is noted that very low values of dominance levels are 
obtained while both K and L are constant. This is desirable due in 


part to easy implementation of constant compensators in practice. The 
Greshgorin bands corresponding to the final compensators are plotted in 


Figures 5.2 and 5.3. 

In the second test category, a nonsquare QCSEE transfer function 
matrix representing an actuator failure in THETAI was used. The out- 
puts in this case were NL,NH, and P8 and the inputs were XMV, and 
X18. Column dominance for the nonsquare DNA design form was sought 
over the range of zero to 5Q Rad/s divided into 100 equally spaced 
points. The initial pre- and post-compensator were 
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(5-31) 


(5-32) 


The dominance levels resulted from utilizing the above compensators 


are 


4.1969 


= 1.1281 


(5-33) 


After a single application of the function minimization program, the 
following dominance levels were obtained 


9^ = 0.98448 


9 2 = 0. 3o873 


(5-34) 


The pre-compen iator associated with the above dominance levels is 
1.0 -1.2885 

.6 


K = 


0.83886 x 10 


0.85 


(5-35) 


The post compensator elements were not varied. Using the dominance 
sharing technique and function minimization in an alternating fasnion 
(as in the previous test category) twice, the T matrix approached 
the identify matrix and the following dominance levels were obtained 


e: = 0.58554 


9 ^ = 0.58544 


(5-36) 
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The pre- and post-compensator corresponding to the dominance levels 
in (5-36) are 


K 


-0.85731 x 10 3 
0.83912 ^ io 6 


-0.11644 x io 30 
0.85 


(5-37) 


and 


( 1.522641 
-1.011035 


0.0 


-1.011035 


0.0 


1.011035 


(5-38) 


The Greshgorin plots corresponding to this case are given in Figures 
5-5 and 5-6. Finally, as in the previous case the dominance is 
obtained with constant pre- and post-compensators. 

5.5 Summary and Discussion 

In this chapter a new method for sensor/actuator failure accomo- 
dation was proposed. The proposed technique is based on Multivariable 
Nyquist Array (MNA) design methodology. Fundamentally, the tech- 
nique provides for restructuring the MNA designed control system 
after the failure is detected and isolated. In order to restructure 
the control system after a sensor/actuator failure, it becomes 
essential to design the controls for unequal number of inputs and 
outputs. To meet this need it is essential to extend the MNA 
techniques to nonsquare system applications. The proposed failure 
accommodation technique is indeed such an extension. 

In the development of the proposed technique, it was shown 
(Section 5.4) that obtaining dominance in the inverse plane for 
nonsquare systems is cumbersome. Alternatively, it was demonstra- 
ted that achieving dominance in the direct polar plane Is feasible. 
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In addition, a set of new conditions relating the dominance in the 
direct and inverse plane was established. These conditions can be 
utilized to assess dominance in the inverse plune using the domi- 
nance levels in the direct plane. Hence, ic follows that under these 
conditions (Theorem 5.2) it is possible to obtain dominance in the 
direct plane and complete the design in either plane. 

The proposed accommodation technique calls for converting the 
nonsquaro system to a square one; thus making standard MNA techniques 
applicable. it was shown (Section 5.3) that in general, dominance 
for converted square systems is only obtainable if the dimension of 
the converted system is equal to the lower dimension of the nonsquare 
system. Based on this result the concept of function minimization 
and dominance sharing are incorporated in the proposed technique to 
achieve dominance. Therefore, the compensator for converting the non- 
square system to a square one is selected such that the resulting 
square system will be dominant. 

The performance o£ the proposed technique was tested by applying 
it to the QCSEE. Two types of tests involving sensor and actuatoi 
failure were conducted. The results of these tests were excellent, as 
in both cases high degree of dominance was obtained without having to 
employ dynamic compensators. Development of the accommodation tech- 
nique in this chapter, together with failure detection and isolation 
in the previous chapters, complete all phases of the proposed failure 
analysis technique. In the next chapter a brief summary of the 
development of all three phases of the proposed failure analysis 

technique will be presented and certain recommendations for future 
research will be made. 



CHAPTER VI 


SUMMARY OF RESULTS AND CONCLUSIONS 

It was established in Chapter I that future jet engines will rely 
on digital controls to meet high performance requirements. The design 
technique of these controls was indicated to be the modern control 
techniques in both the time and frequency domains. A major design 
requirement of digital control implementations in advanced aircraft 
engines is high system reliability. The reliability of the sensors 
and actuators used to implement the control are important aspects of 
this requirement. Improvements in this reliability can be achieved 
by utilizing analytical redundancy. 

Techniques for detection and Isolation of sensor/actuator 
failures utilizing analytical redundancy were closely related to 
engine control design. Specifically, it was Indicated that failure 
analysis techniques compatible with the multivariable frequency 
domain control techniques had significant advantages as they did not 
require state estimation. Therefore, the main objectives of the 
research were to develop a failure analysis technique which utilized 
analytical redundancy and was compatible with the multivariable fre- 
quency domain control design techniques, and to develop a failure 
accommodation capability in the Multivariable Nyquist Array (MNA) 
technique . 

In Chapter If, a new failure detection and isolation technique 
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based on the concept .it Generalized Likelihood Ratio (GLRl was de- 
veloped. The technique did not require multiple hardware redundancy 
and utilized the redundant information embedded in the model residuals. 
Development of the technique focused on three failure types; namely, 
state step, state jump, and sensor step. These failure types cover a 
wide range of possible physical sensor/actuator failures. The techni- 
que was derived for both t ime-vary tng and t inie- invariant linear sys- 
tems. In addition to detection und isolation, the technique provided 
estimates of failure time, direction and magnitude. In the case of 
time-invariant systems a major portion of the computational burden of 
the technique could be accomplished off-line, hence facilitating the 
on-line implementation of the technique. For time- invariant systems, 
a set of recursion relations was derived that simplified the on-line 
implementation of the technique further. Finally, in Chapter II, it 
was demonstration that the GLR technique can also be utilized for soft 
sensor failure detection. 

The results of Chapter III can be summarized under three main 
topics. These topics were: (1) probability distribution of the GL T < 

index; (2) failure detectability of the GLR technique; and (3) asymp- 
totic behavior of the C^d) matrix. Under the first topic the prob- 
ability distribution of tne GLR index was found to have a noncentral 
chi-squared distribution In the case of a failure and a central chi- 
squared if no failure occurred. The knowledge of the probability dis- 
tribution of the GLR index provided the capability of computing four 
important detection probabilities. The probabilities of correct de- 
tection, false alarm, cross detection, and wrong time were used to 
evaluate the confidence, consistency, isolation capability and failure 


time estimate accuracy of the technique, respectively. Under the sec- 
ond topic, the detectability of the failures were examined. It was 
shown thut the technique was always capable of detecting sensor fail- 
ures in both the time-varying and time-invariant systems. The detec- 
tability of uctuator failures was linked to the Invert Ibility of the 
C^(k,t) matrix and it was established that for observable time- Invar- 
iant systems C^(d) is always invertible. The significant impact of 
the behavior of C^(d) on both the detectability and the accuracy of 
failure vector estimate warranted the investigation of the asymptotic 
behavior of C^(d). Hence under the third topic the behavior of the 
C^(d) matrix was studied and thir provided more insight into the ef- 
fects of observation numbeis on the detectability of failures and the 
accuracy of failure estimates. 

The performance 01 the GLR technique was evaluated in Chapter IV 
by applying the technique to a Quiet Clean Short-Haul Experimental 
Engine (QCSEE) . For this purpose a reasonably detailed nonlinear 
simulation of the engine was utilized. All other required programs 
for simulating single and multiple sensor/actuator failure in the 
QCSEE were developed. The programs included the implementation of 
tiie proposed GLR detection technique with its isc’^tior. capability 
derived from the constrained GLR (CGLR) technique. The performance 
evaluation studies were divided into two categories. In the first, 
category perfect modeling ol the engine was assumed while in the 
second category model degradations (imperfect modeling) were per- 
mitted. In the perfect modeling category single and multiple sensor 
and actuator failures were simulated. The performance of the proposed 
GLR technique in all test cases was excellent. Specifically, all 
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sensor and actuator failures were properly and rapidly detected. 

The Isolation of the failed sensors and the estimation of the failure 
size and time were also successfully accomplished In all simulation 
tests. Small inaccuracies occurred in the estimates of failure time 
for actuators. 

In the Imperfect modeling tests, single and multiple sensor/ 
actuator failures were simulated In the QCSEE. The results of these 
tests were also quite satisfactory. For these tests the technique 
continued to detect single eensor/actuator failures properly with 
small Inaccuracies in identifying the failure types. It should be 
emphasized, however, that no difficulty was encountered in identify- 
ing multiple sensor and actuator failure types properly. Likewise, 
failure times were properly estimated for all sensor failures while 
for actuator failures, the estimates showed small inaccuracies. In 
addition, the estimates of the combined effects of sensor failures 
and model degradations were accurately determined. 

A new failure accommodation technique was developed in Chapter V. 
The technique was based on the Multivariable Nyquist Array control 
design technique. Specifically, it utilized the MNA techniques to 
design the nonsquare systems resulting from the loss of a sensor or 
an actuator. It was shown that obtaining dominance for nonsquare 
systems in the inverse polar plane was cumbersome, thus dominance 
was sought in the dirfef.t polar plane. However, a *.et of new relations 
between dominance in the inverse plane and the direct plane was 
established. These relations could be used for deducing dominance 
in the inverse plane from the dominance levels in the direct plane. 

The accommodation technique called for converting nonsquare systems 
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to square ones. For this purpose a new general guideline applicable 
to nonsquare systems of any dimension was developed. Based on this 
guideline a suite of programs for handling nonsquare systems was 
developed. Using these programs the new accommodation technique was 
applied to the QCSEE for both sensor and actuator accommodation. The 
results of these tests were excellent, as high levels of dominance 
were obtained without having to utilize dynamic compensators. 

In brief, the achievements of this research include: 

1. The development of a new, fast, and reliable failure detection 
and isolation technique which is compatible with modern multivariable 
control design techniques and does not require hardware redundancy. 

2. The development of general computer algorithims for applica- 
tion of the proposed detection and isolation technique to any linear 
time-invariant dynamic system. 

3. The successful application of the proposed technique to an 
actual engineering system, namely the QCSEE, 

4. The extension of MNA design techniques to nonsquare systems 
for sensor/actuator failure accommodation. 

5. The derivation of a new relationship between the dominance 
levels in the direct polar plane and the inverse polar plane. 

6. The development of a suite of programs for MNA design of non- 
square systems. 

7. The successful application of the accommodation technique to 
the QCSEE. 

From the results of this research it can be concluded that the 
proposed failure analysis technique provides a fast, reliable, and 
accurate method for sensor /actuator failure analysis of future jet 
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engines . 

There are several areas in which further research could lead to 
significant results. First, although performance of the proposed 
detection technique under model degradation was investigated, more 
studies concerning the effects of model degradation are needed. 

Second, the study of t lie computational requirement of the GLR techni- 
que for on-line implementation is also very important. It is noted 
the results of the studies of model degradation effects are of 
fundamental importance for the computational requirement studies. 

If an imperfect model with a low computational requirement can still 
provide reliable detection, then the on-line implementation becomes 
more feasible. Another significant research area is the problem of 
cross detection, as wrong type detection could severely degrade 
engine performance. 

For more long term future research, several significant areas 
can be ide. .ified us follows. It was demonstrated in Chapter II that 
the concept of CLK can be applied to the problem of soft failure. 
However, much work remains to be done to develop a complete failure 
analysis methodology parallel to the hard failure analysis in the 
previous chapters. Also of significant importance is tin: investigation 
of the simultaneous failures in sensors and actuators. Finally, the 
detection and isolation of several failures which occur in sequence is 
of great practical importance. 
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Figure 1.1. - SInele 
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Figure 1.2. - Typical engine control configuration. 
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Figure 2.1. - Failure detection with Kalaan-Bucy filter. 







170 



Figure 2.2. - Failure detection with plant aodel. 
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Figure 4.1. - UTW experimental propulsion system 
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Sure 4.4. - QCSEE sensor/act uator failure detection plan us tp linear engine aodel. 






Figure 4.5 - Continued. Logic flow diagram for the CLR 
detection program. 
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Figure 4.5 - Concluded. Logic flow diagram for the CtR detection program 
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Figure A. 13. - Plot of the estimate of failure size for PS11 
versus the number of observations. 
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Figure 4.14. - Plot of the estimate of failure size for 
versus the number of observations. 
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Figure 4.15. - Plot of the estimate of failure size in 13 versus 
observation for single failure in T3. 
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Figure 4. 23. - Plot of the estimate of failure size in PS11 versus observation number 
for simultaneous failures in PS11, NH, P12, and T3. 





m 


nOIGlNM- P ftG ?.£ 



Figure 4.25. - Plot of the estimate of failure site In t 3 versus observations for 
simultaneous failure In PS11, NH. PS11, and T3. 
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Evolution of maximum CLR Index for multiple failure In IMV1 . X18. and THETAI 
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Figure 4.29. - Plot of the estiiaate of the failure size for single failure in PS11. 
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Figure 4.31. - Evolution of maximum GLR index for multiple failure in PS11, 
P12, P4, and T3 sensors. 
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Figure 4.32. - Evolution of maximum GLR index for single step failure in THETAI 
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Figure 4.33. - Evolution of maximum GLR index for single jump failure in THETAI. 
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Figure 4.35. - Evolution of maximum GLR index for multiple jump failure in XMV, XI 8 , THETAI 
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This appendix Is comprised of two parts. In the first part a 
theorem concerning the sum of positive definite matrices Is presented 
and In the second part various definitions and proofs concerning the 
matrix norms are given. 


PART B.l: 


Theorem: Let for 1 • 1, 2, ...» R be R positive definite ma- 

trices of order n then the matrix S defined as: 

A 

H-Z’t 

1-1 

is also positive definite. 


Proof: The proof Is given by Induction. Since Is positive defin- 

ite then by definition 

x T V lX > 0 (B-l) 


for any nonzero vector x. 
hence, 


Similarly let 


be positive definite, 


for any nonzero vector x. Now adding the two Inequalities in equations 
(B-l) and (B* 2) results in 


x T V^x + x f V^x > 0 
x T (V 1 x + V^x) > 0 

x T ( Vi + Vj)x > 0 


(B— 3 ) 
(B— 4) 


(B-5) 
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Therefore the theorem is true for R - 2. Now let 
K-l 

S R-1 ’ Z V i 

i-1 

be positive definite. Then by applying equations (B-l) to (B-5) for 
and V R the proof will be completed. 

PART B. 2 : 

Definition: A norm is a function that assigns to every vector x in a 

given vector space a real number denoted by j|x|| such that is satis- 


fies the following conditions: 

1 - | |x| | > 0 for x j 0 (B— 6 ) 

2 - |{x|| “ 0 for x ■ 0 (B— 7 ) 

3 - | |ax| | - | aj ! I x | | 

where a is scalar and |a| is the absolute value of a 

4 - | | x + y | | | | x | j + | | y | J for all x and y (B-8) 

- I (x,y)| 1 i I x| | | [ y 1 1 (b-9'. 


where (x,y) is the inner product of x and y and |(x,y)| is the ab- 
solute value of (x,y) 

Definition: A norm of an n * n matrix A is defined as 

| lA| | - Minimum K (B-10) 

such that 

I J AXj | < K | | X| | (B-ll) 

where | [ A || denotes the norm of matrix A and K is a scalar. 
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Theorem: The norms of sny two n * n matricss satisfy the following 

property 

J I ABl I < J|a|| 1 1 b| | (B-12) 

The proof is given in reference 6, however , it is repeated here for the 
sake of completeness. First it is necessary to show that for any vec- 
tor x the following holds 

l|AX|| £ ||A|| | |X| | (B-13) 

This simply follows from the definition of | | a{ J . Since min K ■ ||a|| 
then by direct substitution in equation (B-ll) the equation (B-13) will 
result. Now consider the vector ||ABX||, by applying the equation 
(B-12) twice one can write 

IIabxJI - ] I A (BX) J I < 1 | A| I J I BXj | < 1 ! A) I 1 I b| I 1 1 x| I 

Let 

K- ! I a| | 1 1 b| [ 

then 

I I ABX| | < K ||X|) 

hence by equation (B-10) | | AB | | ■ Min K which proves that 

l|AB|| < | j A | | | | B } | 

An immediate result of the above theorem is that 



ORIGINAL PAS'C IS 

OF POOR QUALITY. 



ORIGINAL P.-f,:- j‘J 

OF POOR QUALITY 

APPENDIX C 

SENSOR NOISE COVARIANCE ESTIMATE 

Consider the logarithm of the likelihood ratio given In equation 
(2-96). It can be written as 

k 

log L - loglbj «■ log(S 2 | ’ | Tr S 2 ^ r(j)r T (j) 

J-t 

k 

+ 2 Tr S I Y r<J)rT(;1) <C-1) 

J-t 

Differentiating with respect to S 2> the first and the last terms will 
be eliminated. The third term can be written as: 


IV 14 

Tr s 2 Y r( J >rT U> " Y S iJ q 


ij 


(C-2) 


j-t 


ii J-l 


where is the ijth element of S 2 matrix and q^ represents 

the ijth element of the following matrix: 


Q - Yj r <j) rT <J) 
J-t 


(—3) 


Therefore the terms involving S 2 in equation (C-l) can be written as 


8 " 2 (k * t) lo gl S 2 l " 2 Y S ij q 


ij 


(C-4) 


l.J-1 


Now differentiating with respect to S one can write 


3S 


I*" -I t)/|: 


as. 


ii 


3S 


ii 


1 

2 q ii 


(05) 
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»|S 2 I 


Note that the term 77 — Is equal to the cofactor of S... This is 

3S ii 11 

easily seen by expansion of J | • Then 


_3 

3S 


ii 


- \ (K - t) Cof S il /|S 2 | - 


2 q ii 


(C~ 6 ) 


Similarly when taking the partial derivative with respect to 


<k - 0 Cof s u/I s jI - ’ij 


(C— 7 ) 


Setting and equal to zero results in the following 

3S ii 3S ij 


Cof S 


(k - t) 


r s7T 


ii 


- q 


ii 


Cof S 

<k - tJ -fsTr ‘ q 


u 


Using the fact that Cof 1 S 2 1 is 3*^ element of the in- 


ij 

verse of the matrix one can write 


S 2 - (k - t)Q 


-1 


or 


S 2 - (k - t) 


Yj r O)f T (j) 

J-t 


Note that we have used the fact that q^ = q^. 
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APPENDIX D 

COVARIANCE OF FAILURE VECTOR ESTIMATE 

a 

The failure vector estimate, v, Is used for both Isolation and 
accommodation of the failure in the system. Hence it is Important to 

A 

obtain a measure of the accuracy of v. In this appendix the covariance 

A A 

of v is calculated as the measure of the accuracy of v. The ap- 
proach used here follows the one in reference 3, however, for the sake 
of completeness it is presented here. 

Consider the estimate of the failure vector derived in Section 
2.3.3. For easy reference, it is repeated here as 

v - C^ 1 (k,t)D i (k,t) (D-l) 

where 


k 

C i (k, t> - Yj G i0.t)V _1 (j)G i (j,t) (D-2) 

j-t 


and 


k 

D i (k,t) - Y G J(J.t)V _1 (j)r(j) (D-3) 

j-t 

where r(j) is the model residual defined is 

r(j) - ^(j) + G i (j,v)v (D-4) 

where r^(j) is a zero mean white Gaussian noise process and 
Gi(j,t)v is the bias in the residuals due to a type of failure. De- 
fine the following relation 
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k 

J-t 


; 

OF POOR QU 


;U-V » / 


(D-5) 


The mean of D^Ck.t) in equation (D-5) is z ro and the cross covariance 
of D^(k,t) and D^(k,t) can be computed as 


EjD 1 (k,t)D^(k,t)] - eJ 


VJ 


£ G^(j,t)V _1 (J)r 1 (j) 

U-t 


->T 


^ G^j.tJv'^jJrO) 


(D-6) 


Substituting for r(j) from equation (D-4) md using the whiteness 
property of r. (j), equation (D-6) can be written as 

k 

E[D i (k,t)D T (k,t)] - ^ G^(j,t)V _1 (j)E[r 1 (j)r^(j)] v" 1 (j)G l (j,t) 

j-t 

or 

k 

E[p i (k,t)D T (k,t)] - G^(j,t)V _1 (j)G i (j,t) (D-7) 

j-t 

comparing equation (D-7) with equation (D-2) yields 

E [^i (k* t)oT (k, t)j - C i (k,t) 0>~8) 

Now the equation (D-3) for D^fk.t) can be rewritten as 
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k k 

D^k.t) - ]T G^(j,t)v‘ 1 r 1 (J) + Cj(j,t)v“ 1 G 1 (j,t)v 
J-t J-t 


or 


D^k.t) - D^ (k» t) + C i (k,t)v 


Next, consider the error In the Maximum Likelihood Estimate 
(given by eq. (D- 1) ) 


[ft. - »)d - V) 1 ] - vv 1 - Ep] - Ep] + Ep] 


The second term on the right-hand side of equation (D-ll) can 
as 

e[vv T ] = E[c‘ 1 (k,t)D l (k,t)v T ] 

Substituting for D^k.t) from equation (D-10) results in 
e[vv T ] - E jc” 1 (k, t)D ^ (k, t)v T + c' 1 (k, t )C ± (k, t)vv T ] 


Since the expected value of 


r t*i t 

l vv ■ vv 


D^Ck.t) is zero, equation (D-13) 


The third term on the right-hand side of equation (D-ll) can 
puted as 

eJvv 1 -] - E[vD^(k,t)c' 1 (k,t)] 

From equation (D-10) it follows that 


[vv 1 ] - e|v[d^ 


T (k,t) + v T C 1 (k,t) 




<D-9) 

(D-10) 

(MLE) 

(D“ll) 

be written 
(D-12) 

(D-13) 

reduces to 
tD-i'O 

be com- 
(D-15) 


or 
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Finally the fourth term on the right-h.md aide of equation (D-ll) 
becomes 



[c' 1 (k,t)D i (k,t)D|(k,t)C^ 1 (k t)] 


(D-17) 


Now substituting for D^(k,t) from equation (D-10) in equation (D-17) 
results in: 


e[vv T ] - E{c' 1 (k,t)[D 1 (k,t 


) + C i (k,t)v]D^(k, 


t)C^ 1 (k,t) 


(D-18) 


Multiplying the terms on the right-hand sidv» of equation (D-18) and 
using the result in equation (D-8) yields 

e[vv T ] - jc” 1 (k,t) + vv T J (D-19) 

Substituting for the terms on the right-hand side of equation (D-ll) 
from equations (D-14), (D-16), and (D-19) yields 

e\(v - v)(v - v) T ] - C‘ 1 (k,t) (D-20) 

Equation (D-20) is the desired result. 
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The system A matrix for QCSEE at 62. 5% power level is 


A 


-0.105005E 
0.106883B 
0.850 1 84 B 
0. 102389B 
0. 895407B 
0.7108678 
-0.729535B 
“0. 1 37935B 


02 0.291 846E 00 0.000000 0.000000 

02- 0. 168912E 02 0.000000 0.000000 

02 0. 5680168 01-0.125307E 02 0.000000 

01 0. 708155 B- 01-0. 4 09 882 E- 01-0. 99 5092 E 01 

03- 0 • 7990 16B 03 0.337876E 01-0. 144357B 03 

02 0.909366B 02-0. 632545b 02-0.283151B 02 

01 0.176629E 01 0.552433E 00 0.000000 

02 0. 333947E 01-0.601115E 01 0.000000 


-0. 131467E-02 0.000000 0.000000 0.000000 

0. 326249E-0 1-0. 100647E-02 0.000000 0. 000000 

0.000000 0.430649E 00 0.401042E-01 0.3884568-01 
0.000000 0. 5 18529E-02 0.482993E-03 0.467838E-03 
-0.21 4287E 01 0.905415E 00 0.205227E 00 0. 198787K 00 
0. 000000-0. 685347E 00-0.169765E 01 0.642603E 00 
0.000000 0. 117756E-05-0.276006E 00 0.000000 

0.000000 0. 7942 1 8E-06 0. 97 1873E-01-Q. 61 9027 E 00 


The B matrix is 


B - 


-0.607694 B-01 
0. 132536B 01 
0. 198737B 04 
0. 240662B 02 
0. 100854B 05 
0. 329770B 05 
•0.731900E 02- 
0. 473328E 04 


0. 103031E-03 
•0.709244B 01- 
0.569287B-02- 
0. 631966E-04- 
0. 370906E 00 
0. 108203E 00- 
•0.196076E 00 
-0.213886B 00 


0.179767E-01 
0.446111E 00 
0. 390624E-04 
0. 439778E- 06 
0.293014E 02 
0. 1791 09E- 02 
0. 34 1769E-02 
0. 382312E-02 


For the following outputs 



P4 

P8 

NL 
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The C matrix Is 
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0. 178340B 01 0. 1 15550B 01 0.000000 0.000000 

0.000000 0.100503E 01 0.000000 0.000000 

0.000000 0.000000 0. 100503F 01 0.000000 

0.000000 0.000000 0.000000 0.100503E 01 

0.000000 0.000000 0.000300 0.000000 

0.000000 0.000000 0.000000 0.000000 

0.000000 0.000000-0. 959950E 01 0.000000 

0.520969B 04-0.335492B 04-0. 213724E 01 0.525182B 03 


0.498601E-02 0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 0.000000 

0.100503E01 0.000000 0.000000 0.000000 

0.000000 0. 100503B 01 0.000000 0.000000 

0.000000 0.000000 0.000000 0.000000 

0. 153103E 02-0. 2044 1 8 E 00 0.250473E-01 0.2426I3E-01 


and the D matrix is 


-0. 14 8495B 00 0.377881E-02 0.680882E-0l“ 

0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 

0.000000 0.000000 0.000000 

0.760177E 04 0.456472E 01-0. 100396E 00 
0. 166 154B 04-0. 172886E 04-0.209075E 03 




The discrete system matrix is 
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0. 437 7437? 

0. O'* 3 3 79 76 
2.7 58 53 73" 

J. 3?OR'>6 96F-C 1 
~ 30.512177 
-4. 1^48767 
-0. ?74?Q551 

- 1 . 57 -> 39 <*? 


.5.9 19 254 87J -i)2-3 # ri'* c 57t3F-')5 

) ± ??97551« 7.16 5*5_2?4r-ai3 

0.22? 55993 0.3? 224697 

0.2 59 31 <* 81 F -02-0. 18< 765tfcF-)2 
-30.767670 0.3?3«??39F- )1 

3.0783167 -3. 0145245 

0.7 73 81 MIF -01 0.267825R3F-01 
0.637?9 , ?7r-0l-0. /86451 69 


).2«')506?lF-'J3-0.4 9036 797f -04-0 .2 7 74436 36 
-0 .6Ofl73?7Rr-0? 0. 12374774F-0? 0.166 7 4167F 
-0.21 748357E-01 0. 16 706 8 78 F -03 0.204607*96 
0.450P5824 0.197147626-05 0.233946866 

"-7, 1 1 4 37*»? 0.79237133 0.648358486 

-1.491 77t 5 0. 52 215 1 86E-02 0.88539732 

-0 .8361 7843F-03 0. 1 3359 095F- 03 0.537118416 
0.3 1 26 62 94F -0 2 0.215729] 56 -03-0. 57 8? 677 IE 


-05-0. 37 89 1942 6-06-0. 5 5294595 E-06* 
-04 3. 13773187E-04 0.124524696-04 
-01 0.304274036-03 0.2 4714542E-62 
-03 0.33591323F-05 0.289463216-04 
r 01 0.100821146-01 0.156580516-01 
-0.13323694 0.42157732E-01 

-03 0.97818661 0.592360456-04 

-0? 0.724142796-02 0.95105529 



ORIGINAL PAGE 15 
OF POOR QUALITY 

APPENDIX F 

qCSEE SENSOR NOISE CHARACTERISTICS 
For the following sensors 


psu 

psi 

NL 

rpm 

NH 

rpm 

P4 

psi 

P12 

psi 

T3 

°R 


the covariance matrix of the sensor noise is 


\ 


0.010147 

12.839860 0 

12.839860 

0.010147 

O 0.010147 

0.0171805 


normalizing V with respect to the nominal value of the sensor measure- 
ments yields 


/ 


1.039941 

0.153229 0 

0.153229 

1.039941 

0 1.039941 

1. 784873 


x 10 


-6 


The following nominal values of the QCSEE actuator inputs at 62.5% power 
are used to compute the failure sizes in the actuators 


XMV - 0.355 in. 

X18 “ 1.87 in. 

THETAI - 119.32 deg. 
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The nominal value of the output sensors are 
PS11 - 11.967 psia 
NL ■ 2653. 34 rpm 
NH - 11958.60 rpm 
P12 - 14.63 psia 
P4 ■ 139. 419 psia 
T3 - 1090.17 °R 
P8 - 15.538 psia 


The sample mean vector of the generated noise sequence for PS11, NL, NH, 
P12, P4, and P8 are 


/ 


0.2927975 
-0.091251 
0.312425 
0. 138931 
-2.19810 
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APPENDIX G 
PROOF OF UNBIASED GLR ESTIMATION 

In this appendix it will be proven that the failure vector esti- 
mate resulting from GLR technique is an unbiased estimate of the failure 
vector. To achieve this consider the expression for failure vector es- 
timate from equation (2-37): 


v - c“ 1 (k,t)D i (k,t) (G-l) 

where C^(k,t) and D^(k,t) are defined in equations (2-35) and (2-36). 
Substituting for D^k.t) from equation (2-36) yields 


v 



Gj(q,t)V~ 1 r(q) 


(C-2) 


Under type i failure hypothesis r(q) is defined as in equation 
(2-27). Now substituting for r(q) from equation (2-27) in equation 
(C-2) yields 


v 


- c‘ 1 (k,t) 


” k 

G^(q,t)V 1 (q)r i (q) 

_q-i 


+ C” 1 (q,t) 


z 

Lq-1 


G^(q,t)V _1 G i (q,t) 


(G— 3 ) 


Taking expected value of both sides of the above equation results in 


H ■ C^Ck.t) 

~ k 

G^(q,t)v“ :l G i (q,t) 


_q-i 


(G-4) 


where the term inside the first bracket in equation (G-3) vanishes be- 
cause r^(j) has a null expected value. On the other hand, the term 
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Inside* the bracket In equation (G-4) ib equal to Cj(k,t) (see eq. 
(2-35)), hen :e 



Therefore v is an unbiased estimator of v. 

a 

The estimate of failure size, a, resulting from the application of 
Constrained CLR (CGLR) technique, given in equation (2-43), is also un- 
biased. To show this, consider the expression for a from equation 
(2-43): 


f^D 1 (k,t) 

fjC 1 (k,t)f j 


(G-6) 


where f^ is the jth direction of the prespecified directions and 
C^(k, t) and P^k.t) are the same as in equations (2-35) and (2-36). 
Substituting for D^k.t) in equation (G-6) from equation (2-36) yields 


a 


^ G^(q,t)V _1 (q)r 1 (q) 
JT1 a 


f K <k,t>£ 3 


+ 


" k 

^ G^(q,t)V" 1 (q)G 1 (q,t) 

_q-i 


f j a 


fjC 1 (k,t)f J 


(G-7) 


Now taking the expected value of both sides of equation (G-7) results in 
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E 



f T 

J 

“k 

C^(q,t)V' 1 (q)G l (q,t) 

V 


£1 J 



fJc^k.Ofj 


(G-8) 


In the above equation the term inside the bracket Is Cj(k,t); thus 
equation (G-8) can be written as 


E 



■ a 


(G-9) 


Hence a Is an unbiased estimator of the failure size a. 

A useful result of the above analysis is that as k the number of 
observations increases the estimate of the failure vector improves. 
However, if the mean of the model residual is different from zero when 
no failure has occurred then the failure vector estimate is not un- 
biased. This can be easily seen from equation (G-3); specifically 



(G-8) 


Similarly if CGLK technique is applied to the residuals with nonzero 
mean the estimate of the failure size will be biased and it is given by 



fJc^k.Of 


In all of the above analysis no assumption regarding the type of 
the failure was made; hence, the above resuits are valid for all three 
types of failure. Also the derivation is ftr time-varying systems but 
clearly is applicable to time-invariant systems. 
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